CVE-2026-74756None▾ SunlitSome docker-compose shipped by the project exposes by default Webadmin REST API publically without proper authentication setup. Version 3.9.1 onward sets a random credential by default on unprotected webadmin endpoints to prevent this wh…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Some docker-compose shipped by the project exposes by default Webadmin REST API publically without proper authentication setup. Version 3.9.1 onward sets a random credential by default on unprotected webadmin endpoints to prevent this while retain convenience.
apache_james < 3.9.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-76168NoneApache James: ManageSieve file implementation cross-user path traversal
CVE-2026-85111High· 8.7Apache James: Denial of service upon MIME parsing
CVE-2026-49939NoneApache James: Negative IMAP ACL administer authorization bypass through JMAP protocol
CVE-2025-66621NoneApache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigred
CVE-2026-76171NoneApache James: SSRF filter bypass in the JMAP PushSubscription web-push client
CVE-2026-92887NoneApache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operation