CVE-2026-74756CWE-1188

CVE-2026-74756: falha em Apache James

Apache James: WebAdmin exposed without authentication on official Docker default

Publicada em

Seguir esta CVE+ Monitorar Apache James

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 0.3%
Some docker-compose shipped by the project exposes by default Webadmin REST API publically without proper authentication setup. Version 3.9.1 onward sets a random credential by default on unprotected webadmin endpoints to prevent this while retain convenience.
Produtos afetados
Apache Software Foundation · Apache James
CVEs relacionadas — Apache James

No mesmo produto, das mais perigosas para as menos.

CVE-2021-40525—Sieve file storage vulnerable to path traversal attacksEPSS 3.8%CVE-2021-40110—Apache James IMAP vulnerable to a ReDoSEPSS 3.0%CVE-2021-38542—Apache James vulnerable to STARTTLS command injection (IMAP and POP3)EPSS 2.3%CVE-2021-40111—Apache James IMAP parsing Denial Of ServiceEPSS 2.2%CVE-2022-28220—STARTTLS command injection in Apache JAMESEPSS 2.0%CVE-2022-22931—Path traversal in Apache James 3.6.1EPSS 1.8%