---
id: CVE-2026-74756
title: >-
  Apache James: WebAdmin exposed without authentication on official Docker
  default
summary: >-
  Some docker-compose shipped by the project exposes by default Webadmin REST
  API publically without proper authentication setup.

  Version 3.9.1 onward sets a random credential by default on unprotected
  webadmin endpoints to prevent this wh…
severity: none
cwe:
  - CWE-1188
vendor: Apache Software Foundation
product: Apache James
affected:
  - apache_james < 3.9.1
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T11:43:38.423Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74756'
references:
  - url: 'https://lists.apache.org/thread.html/5zhn007mc3jz691zhb2687ow2n7f0zp0'
tags:
  - cve.org
ingestedAt: '2026-11-06T12:51:23.203Z'
---

## Overview

Some docker-compose shipped by the project exposes by default Webadmin REST API publically without proper authentication setup.
Version 3.9.1 onward sets a random credential by default on unprotected webadmin endpoints to prevent this while retain convenience.

## Affected

- `apache_james < 3.9.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.