Apache James Docker images exposed the WebAdmin REST API without authentication when deployed with the default configuration. This allows an unauthenticated user to retrieve or modify administrative settings, potentially leading to unauthorized changes or service disruption. The flaw is an insecure default configuration classified as CWE‑1188.

The vulnerability affects Apache James distributions that rely on the official Docker images prior to version 3.9.1. All older images ship with the WebAdmin endpoint reachable on the default management port without any credential enforcement. Users running these images in a public or less‑restricted environment are at risk.

EPSS data is not available and the vulnerability is not listed in the KEV catalog, so a precise exploitation probability cannot be quantified. However, because the endpoint is openly accessible, the risk is high if the container is reachable from untrusted networks. Attackers can use the exposed API before any authentication is added, and the vulnerability is known to be mitigated only by building a random credential into the image or explicitly enabling authentication.