CVE-2026-49939None▾ SunlitIn Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol. This results in users being able to administer fold…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol.
This results in users being able to administer folders in JMAP despite having being explicitly denied the right to do so in IMAP.
Users are recommended to upgrade to version 3.9.1 which fixes this issue.
apache_james >= 3.9.0 < 3.9.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-74756NoneApache James: WebAdmin exposed without authentication on official Docker default
CVE-2026-76168NoneApache James: ManageSieve file implementation cross-user path traversal
CVE-2026-85111High· 8.7Apache James: Denial of service upon MIME parsing
CVE-2025-66621NoneApache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigred
CVE-2026-76171NoneApache James: SSRF filter bypass in the JMAP PushSubscription web-push client
CVE-2025-49707High· 7.9Azure Virtual Machines Spoofing Vulnerability