The vulnerability resides in Bulwark Webmail's getClientIP() function, which incorrectly trusts the leftmost entry of the X‑Forwarded‑For header supplied by the client. Because that header is fully under the attacker's control, it can be manipulated to masquerade as any IP address. This permits bypassing IP‑based rate limits that protect the administrative login, enabling brute‑force attempts, and also allows forging entries in audit logs so that malicious activity appears to originate from an arbitrary IP. The weakness falls under a trust boundary error (CWE‑348).

Bulwark Mail Server's self‑hosted webmail client, Bulwark Webmail, is affected. The vulnerability exists in all releases prior to version 1.4.11. Users running Bulwark Webmail before that update are at risk.

The CVSS score of 8.7 indicates high severity. Although the EPSS score is not available, the flaw can be exploited by any client who can reach the web application, without authentication, by sending a crafted request containing a forged X‑Forwarded‑For header. Because the header is normally processed by gateways or proxies, the attack vector is typically an externally reachable web server. The vulnerability is not listed in CISA’s KEV catalog, but its impact on authentication and audit integrity makes it a serious threat to exposed deployments.