The vulnerable Bulwark Webmail component configured a Content‑Security‑Policy‑Report‑Only header instead of an enforcing Policy. This oversight allowed cross‑site scripting (XSS) payloads supplied through HTML emails to execute unchallenged in the user’s browser. The attacker could run arbitrary JavaScript in the application context, potentially stealing session cookies or performing actions on behalf of the user. This is a classic reflected or stored XSS flaw (CWE‑79).

The flaw exists in Bulwark Mail’s self‑hosted webmail client for the Stalwart Mail Server. Versions prior to 1.4.11 are affected, including 1.4.10 and earlier. Administrators managing the webmail instance must review installed versions and apply the fix when available.

The CVSS score is 5.3, indicating moderate severity, while the EPSS score is less than 1%, suggesting a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to embed malicious scripts into an email that a user opens or views, so the attack vector is client‑side web interface access. Although the risk is moderate, the potential for session hijacking and unauthorized actions warrants timely remediation.