Apache James mail server access control flaws

Flaws in this mail server let logged-in users reach others' mail and settings.

Summary

Several access control flaws in the Apache James mail server were fixed together. A user with a valid account can get into the mail server without authorization or change other users' settings, and the project's default Docker setup exposes the admin API without authentication.

Affected when

SASL OAUTHBEARER without introspection configured
Project's default docker-compose setup
Attacker holding a valid login account

What to do

Update to Apache James 3.9.1 or later. From 3.9.1, the admin features in the default Docker setup get a random credential automatically.

Products and platforms

Windows
macOS
Linux
Apache James

CVE IDs

Sources

Advisory: lists.apache.org (opens in a new tab) · lists.apache.org (opens in a new tab) · lists.apache.org (opens in a new tab) · lists.apache.org (opens in a new tab) · lists.apache.org (opens in a new tab) · lists.apache.org (opens in a new tab)

Times

First published 2026-11-06 11:38 UTC

First seen 2026-11-09 17:40 UTC