CVE-2026-34833: Bulwark Webmail Information Disclosure

CVE-2026-34833 Overview

CVE-2026-34833 is a Sensitive Data Exposure vulnerability affecting Bulwark Webmail, a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the GET /api/auth/session endpoint included the user's plaintext password in the JSON response body. This critical information disclosure flaw exposed user credentials to browser logs, local caches, and network proxies, creating significant opportunities for credential theft and account compromise.

Critical Impact

User credentials exposed in plaintext through API responses, enabling credential theft via browser history, proxy logs, and network interception.

Affected Products

• Bulwark Webmail versions prior to 1.4.10
• Self-hosted deployments using Stalwart Mail Server with Bulwark Webmail
• Any environment where the /api/auth/session endpoint was accessible

Discovery Timeline

• 2026-04-02 - CVE-2026-34833 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-34833

Vulnerability Analysis

This vulnerability falls under CWE-312 (Cleartext Storage of Sensitive Information). The fundamental security issue is that the authentication session endpoint returns sensitive credential data in its response payload when it should only return session tokens or minimal user information necessary for client-side operations.

When a user authenticates with Bulwark Webmail, subsequent requests to the /api/auth/session endpoint would return a JSON object containing not only session information but also the user's plaintext password. This design flaw violates the principle of least privilege and exposes credentials across multiple potential attack surfaces including browser developer tools, browser history/caching mechanisms, HTTP proxy logs, and network traffic inspection points.

Root Cause

The root cause of this vulnerability is improper handling of sensitive data in the API response serialization. The session endpoint was designed to return user context information but inadvertently included the password field from the user object without proper filtering. This represents a failure to implement proper data sanitization before sending responses to the client, a common oversight when entire user objects are serialized to JSON without explicit field selection.

Attack Vector

The attack vector is network-based and requires no special privileges or user interaction. An attacker could exploit this vulnerability through several methods:

1. Proxy/Network Interception: Any network intermediary (corporate proxies, ISP equipment, compromised routers) could capture and log the plaintext passwords from API responses
2. Browser History Mining: Malware or unauthorized access to a user's workstation could extract credentials from browser caches, history, or developer tools logs
3. Shared Environment Exposure: In shared computing environments, subsequent users could potentially access cached API responses
4. Log File Analysis: Server-side access logs or debugging logs might capture the full response bodies containing passwords

The vulnerability does not require authentication to understand, though exploiting it would typically require access to network traffic or local storage where the responses are cached.

Detection Methods for CVE-2026-34833

Indicators of Compromise

• Unusual access patterns to the /api/auth/session endpoint from unexpected IP addresses
• Evidence of credential harvesting from browser local storage or cache directories
• Unauthorized account access following legitimate session establishment
• Network traffic analysis revealing plaintext passwords in HTTP response bodies

Detection Strategies

• Implement network monitoring to detect plaintext credentials in HTTP/HTTPS response payloads
• Review proxy and web application firewall logs for sensitive data patterns in session endpoint responses
• Deploy data loss prevention (DLP) solutions to flag potential credential exposure in API traffic
• Audit browser storage and cache for improperly stored authentication data

Monitoring Recommendations

• Enable comprehensive logging for all authentication-related API endpoints
• Configure intrusion detection systems to alert on patterns consistent with credential harvesting
• Monitor for bulk requests to the session endpoint that may indicate reconnaissance activity
• Track account access anomalies that could indicate compromised credentials

How to Mitigate CVE-2026-34833

Immediate Actions Required

• Upgrade Bulwark Webmail to version 1.4.10 or later immediately
• Force password resets for all users who may have been affected while running vulnerable versions
• Review proxy logs and browser caches for potential credential exposure
• Audit network traffic logs for evidence of credential interception

Patch Information

The vulnerability has been addressed in Bulwark Webmail version 1.4.10. The patch removes the plaintext password from the session API response, ensuring that only necessary session information is returned to the client. Administrators should upgrade to this version immediately.

For detailed information about the security fix, refer to the GitHub Security Advisory GHSA-47pm-883h-885r and the release notes for version 1.4.10.

Workarounds

• If immediate patching is not possible, implement a reverse proxy or web application firewall rule to strip sensitive fields from the /api/auth/session response
• Consider temporarily disabling access to the vulnerable endpoint while preparing for upgrade
• Implement network segmentation to limit exposure of the webmail application to trusted networks only
• Enable HTTPS with certificate pinning to reduce the risk of man-in-the-middle interception

# Example nginx configuration to strip password field from response (temporary workaround)
location /api/auth/session {
    proxy_pass http://bulwark-backend;
    # Enable response body filtering
    sub_filter_types application/json;
    sub_filter '"password":' '"_redacted":';
    sub_filter_once off;
}