Improper Access Control in Apache James Server Affects Folder Administration
CVE-2026-49939

Currently unrated

Key Information:

Vendor

Apache
Status
Apache James
Vendor
CVE Published:
6 November 2026

What is CVE-2026-49939?

An improper access control vulnerability exists in Apache James Server versions prior to 3.9.1, where the JMAP protocol does not adequately handle the Access Control List (ACL) rules imposed by the IMAP protocol. This flaw allows users to administer folders via JMAP even if they have been explicitly denied permission in IMAP. Users are urged to upgrade to version 3.9.1 or later to resolve this issue and secure their folder administration settings.

Affected Version(s)

Apache James 3.9.0 < 3.9.1

References

https://lists.apache.org/thread.html/7qwsmkk88xbfq4q9o0pz...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks mitchell from revampstudio.com.au for the report
.