Cyber ·
CVE-2026-74756: Apache James WebAdmin API exposed without authentication in default docker-compose
Low-severity advisory on Apache James docker-compose files that exposed the WebAdmin REST API without proper authentication. Versions before 3.9.1 are affected.
On 6 November 2026, an advisory posted to the oss-sec list reported CVE-2026-74756. Some docker-compose files distributed by the Apache James project exposed the WebAdmin REST API by default without proper authentication configured. The severity was rated low, and versions before 3.9.1 are affected. The fix in version 3.9.1 sets random default credentials on unprotected WebAdmin endpoints, keeping installation convenient. Credit for the finding goes to an independent researcher. To check the original advisory, consult the November 2026 oss-sec list archive and the official Apache James references. This text summarizes an automatic translation, so verify the exact wording in the source before acting.