Vulnerability · Published Apr 6, 2026 · Assigned by GitHub_M

CVE-2026-35390Content-Security-Policy was set to Report-Only mode, failing to block XSS attacks

Medium 6.1

In plain English

A medium-severity cross-site scripting in webmail from bulwarkmail. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.2%top 93.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, the reverse proxy (proxy.ts) set the Content-Security-Policy-Report-Only header instead of the enforcing Content-Security-Policy header. This means cross-site scripting (XSS) attacks were logged but not blocked. Any user who could inject script content (e.g., via crafted email HTML) could execute arbitrary JavaScript in the context of the application, potentially stealing session tokens or performing actions on behalf of the user. This vulnerability is fixed in 1.4.11.

Affected products (as reported)

Vendor	Product	Versions
bulwarkmail	webmail	< 1.4.11

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/bulwarkmail/webmail/security/advisories/GHSA-6q52-98cr-qx65 x_refsource_CONFIRM