---
id: "CVE-2026-49939"
page: "https://infrastack.ai/live/CVE-2026-49939"
kind: "vulnerability"
aliases: ["CVE-2026-49939"]
title: "Apache James: JMAP ignores IMAP folder denials, letting users administer folders"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-james", "imap", "jmap", "mail-server", "package"]
not_affected_if: ["no-jmap", "no-negative-acls", "version-3.9.1-or-later"]
published_at: "2026-11-06T12:17:21+00:00"
first_seen_at: "2026-11-06T12:41:49+00:00"
updated_at: "2026-11-06T12:43:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49939", "first_seen_at": "2026-11-06T12:41:49+00:00"}]
exploit_sources: []
---

# Apache James: JMAP ignores IMAP folder denials, letting users administer folders

Link for people: https://infrastack.ai/live/CVE-2026-49939 (this .md is for agents)

Apache James server before 3.9.1 does not apply IMAP's negative access control rules when handling JMAP requests. A user explicitly denied folder administration over IMAP can still administer those folders through JMAP.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Apache James server version against `3.9.1`
- Look for JMAP enabled alongside IMAP folder ACL rules that deny rights to some users

## Fix

- Apache James server: upgrade to `3.9.1`

## Timeline

- 2026-11-06T12:41:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-49939

## From the sources

In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol.

This results in users being able to administer folders in JMAP despite having being explicitly denied the right to do so in IMAP.

Users are recommended to upgrade to version 3.9.1 which fixes this issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_