CVE-2026-49939 · Package
NO FIX YET · SEE WHAT TO DO
Apache James server before 3.9.1 does not apply IMAP's negative access control rules when handling JMAP requests. A user explicitly denied folder administration over IMAP can still administer those folders through JMAP.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organizations running Apache James server before 3.9.1 that expose both IMAP and JMAP and use IMAP folder ACLs to deny some users administration rights. Deployments that do not use JMAP or do not set negative folder ACLs are less exposed.
Not affected if no-jmap, no-negative-acls, version-3.9.1-or-later
Who cares apache-james, imap, jmap, mail-server
3.9.13.9.1In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol.
This results in users being able to administer folders in JMAP despite having being explicitly denied the right to do so in IMAP.
Users are recommended to upgrade to version 3.9.1 which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.