Posted by Benoit Tellier on Nov 06 Severity: moderate Affected versions: - Apache James 3.9.0 before 3.9.1 Description: In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol. This results in users being able to administer folders in JMAP despite having being explicitly denied the right to do so in IMAP. Users are recommended to upgrade to...
CVE-2026-49939: Apache James: Negative IMAP ACL administer authorization bypass through JMAP protocol
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/548
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
CVE-2026-123770: Apache Axis2/Java: Unbounded multipart and form-encoded request bodies
Posted by Robert Lazarski on Nov 06 Severity: low Affected versions: - Apache Axis2/Java before 2.0.2 Description: Allocation of Resources Without Limits or Throttling…
CVE-2026-123766: Apache Axis2/Java: Cross-site scripting in the OpenAPI module's Swagger UI page
Posted by Robert Lazarski on Nov 06 Severity: moderate Affected versions: - Apache Axis2/Java 2.0.1 before 2.0.2 Description: Improper Neutralization of Input During Web…
CVE-2026-123753: Apache Axis2/Java: SSRF via WS-Addressing ReplyTo and FaultTo endpoints
Posted by Robert Lazarski on Nov 06 Severity: important Affected versions: - Apache Axis2/Java before 2.0.2 Description: Server-Side Request Forgery (SSRF) vulnerability…
CVE-2026-120761: Apache Axis2/Java: XML External Entity (XXE) injection via imported WSDL/XSD documents
Posted by Robert Lazarski on Nov 06 Severity: important Affected versions: - Apache Axis2/Java before 2.0.2 Description: Improper Restriction of XML External Entity…
CVE-2026-85111: Apache James: Denial of service upon MIME parsing
Posted by Benoit Tellier on Nov 06 Severity: CVSS 4.0: 8.7 (high) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Affected versions: - Apache James…
CVE-2026-85108: Apache James MIME4J: Denial of service due to Allocation of Resources Without Limits or Throttling
Posted by Benoit Tellier on Nov 06 Severity: important Affected versions: - Apache James Mime4J Core (org.apache.james:apache-mime4j-core) before 0.8.15 - Apache James…