What is GHSA-84j6-j2xp-crm8?

GHSA-84j6-j2xp-crm8 is a security advisory published by GitHub Security Advisories with unknown severity. In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by...

Which CVE IDs does GHSA-84j6-j2xp-crm8 cover?

GHSA-84j6-j2xp-crm8 covers the following CVE IDs: CVE-2026-49939. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-84j6-j2xp-crm8unknown

In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by...

Vendor

GitHub Security Advisories

Published

November 6, 2026

Last Modified

November 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-49939 →

📋 Description

In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol.

This results in users being able to administer folders in JMAP despite having being explicitly denied the right to do so in IMAP.

Users are recommended to upgrade to version 3.9.1 which fixes this issue.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-49939
https://lists.apache.org/thread.html/7qwsmkk88xbfq4q9o0pz9bt8p9p1yjs7
http://www.openwall.com/lists/oss-security/2026/11/06/14
https://github.com/advisories/GHSA-84j6-j2xp-crm8