---
id: CVE-2026-49939
title: >-
  Apache James: Negative IMAP ACL administer authorization bypass through JMAP
  protocol
summary: >-
  In Apache James server prior version 3.9.1 improper Access Control List
  processing is exposed by the JMAP protocol which do not account for negative
  rules positionned by IMAP protocol.


  This results in users being able to administer fold…
severity: none
cwe:
  - CWE-284
vendor: Apache Software Foundation
product: Apache James
affected:
  - apache_james >= 3.9.0 < 3.9.1
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T11:40:59.146Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-49939'
references:
  - url: 'https://lists.apache.org/thread.html/7qwsmkk88xbfq4q9o0pz9bt8p9p1yjs7'
tags:
  - cve.org
ingestedAt: '2026-11-06T11:50:33.388Z'
---

## Overview

In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol.

This results in users being able to administer folders in JMAP despite having being explicitly denied the right to do so in IMAP.

Users are recommended to upgrade to version 3.9.1 which fixes this issue.

## Affected

- `apache_james >= 3.9.0 < 3.9.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.