In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative…
In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol. This results in users being able to administer folders in JMAP despite having being explicitly denied the right to do so in IMAP. Users are recommended to upgrade to version 3.9.1 which fixes this issue.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Apache Software Foundation
- Product
- Apache James
- Fix
- available
- Weakness
- CWE-284
- Exposure class
- Web platform
- NVD status
- Received
Why it ranks 25 (Notable)
- Product class: web platform
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-49939 on this site · NVD · CVE.org · Vulnpedia