{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/apache-james--3.9.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:james:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-74756"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Apache James (\u003c 3.9.1)"],"_cs_severities":["low"],"_cs_tags":["webserver","configuration-issue","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Apache Software Foundation"],"content_html":"\u003cp\u003eApache James versions prior to 3.9.1 contain a configuration vulnerability where the WebAdmin REST API is exposed publicly without requiring authentication when using specific provided docker-compose configurations. This allows unauthenticated users to interact with administrative API endpoints. The project has addressed this in version 3.9.1 by implementing a default random credential requirement for these endpoints to ensure security while maintaining usability.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote actors to access the WebAdmin REST API, potentially leading to unauthorized system administration or configuration changes within the Apache James server environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Apache James to version 3.9.1 or later to leverage the mandatory random default credentials.\u003c/li\u003e\n\u003cli\u003eAudit existing docker-compose deployments to ensure WebAdmin REST API ports are not exposed to untrusted network segments.\u003c/li\u003e\n\u003cli\u003eApply host-based or network-level firewall rules to restrict access to the WebAdmin API ports exclusively to authorized management subnets.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-06T17:22:59Z","date_published":"2026-11-06T17:22:59Z","id":"https://feed.craftedsignal.io/briefs/2026-11-apache-james-webadmin/","summary":"A configuration vulnerability in Apache James default docker-compose files exposes the WebAdmin REST API to public access without authentication, enabling unauthorized administrative interaction.","title":"Apache James: WebAdmin REST API exposed without authentication (CVE-2026-74756)","url":"https://feed.craftedsignal.io/briefs/2026-11-apache-james-webadmin/"}],"language":"en","title":"CraftedSignal Threat Feed - Apache James (\u003c 3.9.1)","version":"https://jsonfeed.org/version/1.1"}