The Apache James server improperly processes Access Control Lists when handling JMAP requests, ignoring negative ACL rules set by the IMAP protocol. This bug allows a user who has been explicitly denied folder administration rights in IMAP to still administer those folders through JMAP, effectively bypassing the intended access controls. The impact is a complete loss of authorization enforcement for protected folders, enabling malicious users to modify, delete, or expose data they should not be able to access.

All installations of Apache James older than version 3.9.1 are affected. The vulnerability is present in any environment where JMAP is enabled and IMAP ACLs are used to deny folder administration rights.

The attack vector is remote and exploits the JMAP interface, which is typically exposed over the network. No public exploit is currently documented and the EPSS score is unavailable, but the absence of any enforcement mechanism grants an attacker the full ability to bypass authorization checks. Consequently, the risk is high for affected deployments, particularly where sensitive or confidential mailboxes are involved. The vulnerability is not listed in CISA’s KEV catalog.