Apache James: WebAdmin REST API exposed without authentication (CVE-2026-74756)
A configuration vulnerability in Apache James default docker-compose files exposes the WebAdmin REST API to public access without authentication, enabling unauthorized administrative interaction.
CVE search metadata
CVE search record: CVE-2026-74756. KEV: no. Product: Apache James (< 3.9.1). Brief: Apache James: WebAdmin REST API exposed without authentication (CVE-2026-74756). Brief link: https://feed.craftedsignal.io/briefs/2026-11-apache-james-webadmin/
Triage facts
Revision 1- Applicability
- Apache James (< 3.9.1)
- Evidence
- Unknown
- Severity
- Low
- Action
- Monitor or close
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 6, 17:22 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- D3Roughly even chance
Apache James versions prior to 3.9.1 contain a configuration vulnerability where the WebAdmin REST API is exposed publicly without requiring authentication when using specific provided docker-compose configurations. This allows unauthenticated users to interact with administrative API endpoints. The project has addressed this in version 3.9.1 by implementing a default random credential requirement for these endpoints to ensure security while maintaining usability.
Impact
Successful exploitation allows unauthenticated remote actors to access the WebAdmin REST API, potentially leading to unauthorized system administration or configuration changes within the Apache James server environment.
Recommendation
- Upgrade Apache James to version 3.9.1 or later to leverage the mandatory random default credentials.
- Audit existing docker-compose deployments to ensure WebAdmin REST API ports are not exposed to untrusted network segments.
- Apply host-based or network-level firewall rules to restrict access to the WebAdmin API ports exclusively to authorized management subnets.
Threat Hunt
Identify exposed WebAdmin REST API endpoints accessible from the public internet
Data: Network firewall logs showing inbound connections to Apache James management ports
Mitigations
Upgrade Apache James to 3.9.1 or later
CVE-2026-74756