CVE-2026-49939

Full vulnerability record from the local CVENow database.

Description

In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol. This results in users being able to administer folders in JMAP despite having being explicitly denied the right to do so in IMAP. Users are recommended to upgrade to version 3.9.1 which fixes this issue.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-06 12:17:21.517000

Last modified

2026-11-06 19:17:51.697000

View original CVE JSON

{
  "id": "CVE-2026-49939",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-06T12:17:21.517",
  "lastModified": "2026-11-06T19:17:51.697",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol.\n\nThis results in users being able to administer folders in JMAP despite having being explicitly denied the right to do so in IMAP.\n\nUsers are recommended to upgrade to version 3.9.1 which fixes this issue."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache James",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "3.9.0",
              "lessThan": "3.9.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://lists.apache.org/thread.html/7qwsmkk88xbfq4q9o0pz9bt8p9p1yjs7",
      "source": "[email protected]"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/11/06/14",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}