Apache James JMAP Issues: ACL Bypass and SSRF Bypass Reported

1 source · 2 articlesFirst reported Nov 6, 2026 · 16:54 UTCUpdated Nov 6, 2026 · 16:59 UTC (5d ago)1

What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Two vulnerabilities disclosed in Apache James JMAP: CVE-2026-49939 ACL authorization bypass and low-severity CVE-2026-76171 SSRF filter bypass.

Apache James servers prior to 3.9.1 are vulnerable to CVE-2026-49939, where the JMAP protocol fails to respect negative IMAP ACL rules, allowing users to administer folders despite explicit IMAP denials. The Apache James team recommends upgrading to version 3.9.1. Separately, CVE-2026-76171 in the JMAP PushSubscription web-push client permits bypass of the SSRF filter, classified as low severity. Both issues were disclosed on oss-security on 2026-11-06.

Key facts

CVE-2026-49939: JMAP bypasses negative IMAP ACL rules
Affects Apache James < 3.9.1
Fix: upgrade to 3.9.1
CVE-2026-76171: SSRF filter bypass in JMAP web-push client
Low severity
Reported via oss-security

Analyze CVE-2026-49939 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first

Nov 6, 2026oss-security reports CVE-2026-49939 JMAP ACL bypass in Apache James · oss-security
Nov 6, 2026oss-security reports CVE-2026-76171 SSRF filter bypass in Apache James JMAP · oss-security

What each outlet adds

beyond the shared facts

oss-securityDisclosed two related JMAP vulnerabilities in Apache James on 2026-11-06

CVEs: CVE-2026-49939 CVE-2026-76171

Vendors: Apache
Products: James

Coverage

oldest first · one row per article · UTC

Nov 6, 16:54 UTC · 5d ago oss-securityFirst report
CVE-2026-49939: Apache James JMAP ACL bypass
JMAP protocol fails to respect negative IMAP ACL rules, letting users administer folders despite denials; upgrade to 3.9.1 required.
Nov 6, 16:59 UTC · 5d ago oss-security
Apache James SSRF filter bypass in JMAP web-push client
Apache James server allows bypass of the SSRF filter in its JMAP PushSubscription web-push client.

Vulnerabilities in this story

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-76171 +1 related CVE CVE-2026-49939	SSRF bypass in Apache James JMAP webPush before 3.9.1	9.1 group max	—		5d ago