high · CVSS v3 7.5

CVE-2026-49939

In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which…

Description

In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol. This results in users being able to administer folders in JMAP despite having being explicitly denied the right to do so in IMAP. Users are recommended to upgrade to version 3.9.1 which fixes this issue.

Scores

Severity
high
CVSS v2
5
CVSS v3
7.5
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

high

CVE-2026-123293

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool path setting

View analysis

high

CVE-2026-123295

In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint

View analysis

high

CVE-2026-123297

In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow

View analysis