https://seclists.org/oss-sec/2026/q4/548: CVE-2026-49939: Apache James: Negative IMAP ACL administer authorization bypass through JMAP protocol
Published Nov 6, 2026
·Updated
Affected Software
1 affected component
Apache James>=3.9.0<3.9.1
Apache James deployments running version 3.9.0 before 3.9.1 are affected when they use IMAP ACLs with explicit negative rules and expose the JMAP protocol. Users denied folder administration through IMAP may still be able to administer those folders through JMAP.
The attacker needs a user account that is explicitly denied folder administration by an IMAP negative ACL rule, plus access to the JMAP protocol. The flaw allows that denied user to administer folders through JMAP.
Upgrade Apache James to version 3.9.1, which fixes the ACL processing issue. Until upgraded, review JMAP access for users subject to negative IMAP ACL rules.