CVE-2026-49939 Apache James: Negative IMAP ACL administer authorization bypass through JMAP protocol

In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol. This results in users being able to administer folders in JMAP despite having being explicitly denied the right ...

CVE-2026-49939

In Apache James server versions prior to 3.9.1 , improper Access Control List (ACL) processing in the JMAP protocol allows for an authorization bypass. The vulnerability occurs because JMAP fails to account for negative rules defined by the IMAP protocol , enabling users to administer folders via...

CLSA-2026-1780910915 dovecot: Fix of 3 CVEs

CVE-2026-40020: imap-acl: reject CR/LF/control-char and non-UTF-8 injection in SETACL identifier - CVE-2026-42006: lib-imap: fix listcountlimit to actually bound '' incomplete fix for CVE-2026-27857 - CVE-2026-40016: lib-sieve: enforce sievemaxcputime inside :contains/:matches matcher loops...

Cyrus IMAP 2.5.x < 2.5.15, 3.0.x < 3.0.13 ACL Bypass Vulnerability

Cyrus IMAP is prone to an ACL bypass vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:cyrus:imap"; if description...