Apache James WebAdmin exposed without authentication on official Docker default (CVE-2026-74756)
WebAdmin is exposed without authentication in the official Docker image for Apache James.
20
CVE-2026-74756
Unauthenticated WebAdmin exposure in Apache James Docker
- CVSS 3.1
- 9.1 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache James docker-compose exposes the WebAdmin REST API publicly by default without authentication. Attackers trigger this by running the official Docker image and accessing the endpoint over the network. They gain unauthenticated access to the WebAdmin interface. Users of Apache James Docker before version 3.9.1 are affected.
What to do: Upgrade Apache James to version 3.9.1 or later. Apply Apache's update for CVE-2026-74756.
| Product | Affected | Fixed in |
|---|---|---|
| Apache James | before 3.9.1 | 3.9.1 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Some docker-compose shipped by the project exposes by default Webadmin REST API publically without proper authentication setup. Version 3.9.1 onward sets a random credential by default on unprotected webadmin endpoints to prevent this while retain convenience.
- Weakness
- CWE-1188
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N