https://seclists.org/oss-sec/2026/q4/549: CVE-2026-74756: Apache James: WebAdmin exposed without authentication on official Docker default
Published Nov 6, 2026
·Updated
Affected Software
1 affected component
Apache James<3.9.1
Apache James deployments using project-shipped docker-compose configurations that expose the WebAdmin REST API publicly without proper authentication are affected. Versions before 3.9.1 are affected.
An attacker needs network access to a publicly exposed WebAdmin REST API endpoint that lacks proper authentication. No additional credentials are indicated for the affected configuration.
Yes. The issue concerns docker-compose configurations shipped by the project that expose WebAdmin publicly by default without proper authentication setup.
Version 3.9.1 and later set a random credential by default on unprotected WebAdmin endpoints, preventing unauthenticated access while retaining convenience.