{"id":"CVE-2026-49939","kind":"vulnerability","aliases":["CVE-2026-49939"],"related":[],"title":"Apache James: JMAP ignores IMAP folder denials, letting users administer folders","description":"In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol.\n\nThis results in users being able to administer folders in JMAP despite having being explicitly denied the right to do so in IMAP.\n\nUsers are recommended to upgrade to version 3.9.1 which fixes this issue.","summary":"Apache James server before 3.9.1 does not apply IMAP's negative access control rules when handling JMAP requests. A user explicitly denied folder administration over IMAP can still administer those folders through JMAP.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-james","imap","jmap","mail-server","package"],"not_affected_if":["no-jmap","no-negative-acls","version-3.9.1-or-later"],"how_to_check":"- Check the installed Apache James server version against `3.9.1`\n- Look for JMAP enabled alongside IMAP folder ACL rules that deny rights to some users","fix":"- Apache James server: upgrade to `3.9.1`","status":"open","published_at":"2026-11-06T12:17:21+00:00","first_seen_at":"2026-11-06T12:41:49+00:00","triaged_at":"2026-11-06T12:43:00+00:00","updated_at":"2026-11-06T12:43:00+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T12:43:00Z","model":"claude-haiku-5-5","output":{"fix":"- Apache James server: upgrade to `3.9.1`","reach":"network","title":"Apache James: JMAP ignores IMAP folder denials, letting users administer folders","impact":"medium","summary":"Apache James server before 3.9.1 does not apply IMAP's negative access control rules when handling JMAP requests. A user explicitly denied folder administration over IMAP can still administer those folders through JMAP.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-james","mail-server","jmap","imap"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated users change folders they were denied over IMAP","analyst_note":"","how_to_check":"- Check the installed Apache James server version against `3.9.1`\n- Look for JMAP enabled alongside IMAP folder ACL rules that deny rights to some users","plain_action":"","needs_analyst":false,"not_affected_if":["version-3.9.1-or-later","no-jmap","no-negative-acls"],"who_is_affected":"Organizations running Apache James server before 3.9.1 that expose both IMAP and JMAP and use IMAP folder ACLs to deny some users administration rights. Deployments that do not use JMAP or do not set negative folder ACLs are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000672,"input_tokens":4245,"output_tokens":494,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-49939':14A,17A '3.9.1':31B,66C,119C 'abl':94C 'access':38B,68C 'account':81C 'administ':10A,55B,96C 'administr':50B 'apach':1A,19B,27B,61C 'apache-jam':18B 'appli':34B 'control':39B,69C 'cve':12A,15A 'deni':48B,104C 'denial':7A 'despit':100C 'explicit':47B,103C 'expos':73C 'fix':121C 'folder':6A,11A,49B,57B,97C 'handl':42B 'ignor':4A 'imap':5A,21B,35B,52B,87C,111C 'improp':67C 'issu':123C 'jame':2A,20B,28B,62C 'jmap':3A,22B,43B,59B,76C,99C 'let':8A 'list':70C 'mail':24B 'mail-serv':23B 'negat':37B,83C 'packag':26B 'posit':85C 'prior':64C 'process':71C 'protocol':77C,88C 'recommend':114C 'request':44B 'result':90C 'right':106C 'rule':40B,84C 'server':25B,29B,63C 'still':54B 'upgrad':116C 'user':9A,46B,92C,112C 'version':65C,118C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Apache James server before 3.9.1 that expose both IMAP and JMAP and use IMAP folder ACLs to deny some users administration rights. Deployments that do not use JMAP or do not set negative folder ACLs are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apachejames","imap","jmap","mailserver","medium","package"],"campaign_type":null,"search_a":"'-2026':13A,16A '-49939':14A,17A 'administ':10A 'apach':1A 'cve':12A,15A 'denial':7A 'folder':6A,11A 'ignor':4A 'imap':5A 'jame':2A 'jmap':3A 'let':8A 'user':9A","search_b":"'3.9.1':31B 'access':38B 'administ':55B 'administr':50B 'apach':19B,27B 'apache-jam':18B 'appli':34B 'control':39B 'deni':48B 'explicit':47B 'folder':49B,57B 'handl':42B 'imap':21B,35B,52B 'jame':20B,28B 'jmap':22B,43B,59B 'mail':24B 'mail-serv':23B 'negat':37B 'packag':26B 'request':44B 'rule':40B 'server':25B,29B 'still':54B 'user':46B","search_c":"'3.9.1':66C,119C 'abl':94C 'access':68C 'account':81C 'administ':96C 'apach':61C 'control':69C 'deni':104C 'despit':100C 'explicit':103C 'expos':73C 'fix':121C 'folder':97C 'imap':87C,111C 'improp':67C 'issu':123C 'jame':62C 'jmap':76C,99C 'list':70C 'negat':83C 'posit':85C 'prior':64C 'process':71C 'protocol':77C,88C 'recommend':114C 'result':90C 'right':106C 'rule':84C 'server':63C 'upgrad':116C 'user':92C,112C 'version':65C,118C","first_public_at":"2026-11-06T12:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-49939","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49939","severity":null,"published_at":"2026-11-06T12:17:21+00:00","modified_at":"2026-11-06T12:17:21+00:00","first_seen_at":"2026-11-06T12:41:49+00:00","fetched_at":"2026-11-06T12:41:49+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}