Severity: low Affected versions:
- Apache James before 3.9.1 Description: Some docker-compose shipped by the project exposes by default Webadmin REST API publically without proper authentication setup. Version 3.9.1 onward sets a random credential by default on unprotected webadmin endpoints to prevent this while retain convenience. Credit: Wanxin Yin (finder) References: https://james.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-74756
