VulDB 🛡@vuldb
⚠️ The severity is increased for this new vulnerability affecting Apache James (CVE-2026-49939) vuldb.com/vuln/431899 https://t.co/9PucGfbMzr
00000117
2.3K followersView on X
CVE-2026-49939
LOWSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol. This results in users being able to administer folders in JMAP despite having being explicitly denied the right to do so in IMAP. Users are recommended to upgrade to version 3.9.1 which fixes this issue.
0.0/ 10 priority
Sources & remediation
Other references
Weakness type (CWE)
CWE-284
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day