WhatBrokeToday
Today's Trends
highInvestigatingApachevprior to version 3.9.1

Apache James server: CVE-2026-49939 (High)

  1. Investigating(current)
  2. Trending(upcoming)
  3. Workaround available(upcoming)
  4. Resolved(upcoming)

Executive summary

Apache James server prior to version 3.9.1 is vulnerable to a High severity issue where improper Access Control List processing in the JMAP protocol allows users to administer folders despite being denied rights in IMAP.

No verified workaround yet

None of the linked reports describe a mitigation. Follow this incident to hear when one appears.

Official fix
Technical root cause

Improper Access Control List processing in the JMAP protocol does not account for negative rules positioned by IMAP, leading to unauthorized folder administration.

Evidence

1 report · 1 CVEShow
  1. [1]
    CVE First report
    Apache James server: CVE-2026-49939 (High)(opens security advisory in a new tab)

    High severity. In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol. This results in users being able to administer folders in JMAP despite having being explicitly denied the right to do so in IMAP. Users are recommended to upgrade to version 3.9.1 which fixes this issue.

    by Tenable 0upvotes 0comments

Timeline

  1. First report on security advisory

    Apache James server: CVE-2026-49939 (High)

    Source