CVE-2026-74756 Apache James: WebAdmin exposed without authentication on official Docker default
CriticalCVSS 9.1
- Published
- Updated
- Exploit status
- No public exploit known
Description
Some docker-compose shipped by the project exposes by default Webadmin REST API publically without proper authentication setup.
Version 3.9.1 onward sets a random credential by default on unprotected webadmin endpoints to prevent this while retain convenience.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache James | < 3.9.1 | 3.9.1 |
References
- lists.apache.org vendor-advisory
- www.openwall.com