The vulnerability is an SSRF filter bypass in the JMAP PushSubscription web‑push client of Apache James, where improper validation allows a remote actor to reach internal network addresses. This can enable enumeration or interaction with internal services and could lead to the compromise of internal resources or data. The weakness is classified as CWE‑918, indicating a flaw in source validation for outbound HTTP requests.

Apache James servers running any version earlier than 3.9.1 are affected. The issue was fixed in version 3.9.1; users are instructed to upgrade to that release or newer.

The EPSS score is not available and the vulnerability is not listed in CISA KEV, so a formal exploitation probability is unknown. Based on the description, the likely attack vector is remote exploitation via the JMAP interface, which can be accessed from external networks. The severity could be high due to the potential internal network reachability, but exact CVSS metrics are not disclosed in the provided data.