CVE-2026-49939
Apache James: Negative IMAP ACL administer authorization bypass through JMAP protocol
In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol.
This results in users being able to administer folders in JMAP despite having being explicitly denied the right to do so in IMAP.
Users are recommended to upgrade to version 3.9.1 which fixes this issue.
Exploit likelihood
What each source reports
CVE List No score
Apache James: Negative IMAP ACL administer authorization bypass through JMAP protocol
In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol.
This results in users being able to administer folders in JMAP despite having being explicitly denied the right to do so in IMAP.
Users are recommended to upgrade to version 3.9.1 which fixes this issue.
- Record
CVE-2026-49939- Weakness
- CWE-284
- Updated
- 2026-11-06
EUVDEUVD-2026-118216 No score
In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol.
This results in users being able to administer folders in JMAP despite having being explicitly denied the right to do so in IMAP.
Users are recommended to upgrade to version 3.9.1 which fixes this issue.
- Record
EUVD-2026-118216- Updated
- 2026-11-06
GitHub AdvisoriesGHSA-84j6-j2xp-crm8 No score
In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by...
In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol.
This results in users being able to administer folders in JMAP despite having being explicitly denied the right to do so in IMAP.
Users are recommended to upgrade to version 3.9.1 which fixes this issue.
- Record
GHSA-84j6-j2xp-crm8- Weakness
- CWE-284
- Updated
- 2026-11-06
NVD No score
In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol.
This results in users being able to administer folders in JMAP despite having being explicitly denied the right to do so in IMAP.
Users are recommended to upgrade to version 3.9.1 which fixes this issue.
- Record
CVE-2026-49939- Weakness
- CWE-284
- Updated
- 2026-11-06
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| references | CVE List, EUVD | |
| published | EUVD | |
| published | EUVD, NVD | |
| aliases, published | EUVD | |
| aliases, references | GitHub Advisories | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-49939 is a vulnerability with no CVSS score yet in Apache Software Foundation James, published November 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 10th percentile. No source names a fixed version.