CVE-2026-49939: Apache James JMAP ACL bypass
Original title: CVE-2026-49939: Apache James: Negative IMAP ACL administer authorization bypass through JMAP protocol
JMAP protocol fails to respect negative IMAP ACL rules, letting users administer folders despite denials; upgrade to 3.9.1 required.
Apache James server prior to version 3.9.1 exposes improper Access Control List processing via the JMAP protocol. Negative rules set by IMAP are not accounted for, resulting in users able to administer folders in JMAP despite explicit IMAP denials. The Apache James team recommends upgrading to 3.9.1.
- Affected versions: Apache James 3.9.0 before 3.9.1
- JMAP protocol bypasses IMAP ACL negative rules
- Allows unauthorized folder administration
- Fix: upgrade to 3.9.1
Impact: unauthorized folder administration in JMAP despite IMAP ACL denial
- 1.Upgrade to Apache James 3.9.1
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-49939 | JMAP ACL bypass in Apache James before 3.9.1 | 7.5 | — |
From the original article
Posted by Benoit Tellier on Nov 06 Severity: moderate Affected versions: - Apache James 3. 9. 0 before 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.