Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:apache:james:*:*:*:*:*:*:*:*

2 briefs RSS
low advisory

Apache James: WebAdmin REST API exposed without authentication (CVE-2026-74756)

A configuration vulnerability in Apache James default docker-compose files exposes the WebAdmin REST API to public access without authentication, enabling unauthorized administrative interaction.

Apache James webserver configuration-issue vulnerability
1c
high advisory

Apache James: ManageSieve cross-user path traversal (CVE-2026-76168)

Apache James versions prior to 3.9.1 are vulnerable to a path traversal flaw in the SieveFileRepository, allowing authenticated attackers to inject malicious SIEVE scripts into other users accounts.

James
1t 1c