{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74756","assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","state":"PUBLISHED","assignerShortName":"apache","dateReserved":"2026-08-15T07:16:22.830Z","datePublished":"2026-11-06T11:43:38.423Z","dateUpdated":"2026-11-06T19:05:09.800Z"},"containers":{"cna":{"providerMetadata":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-11-06T11:43:38.423Z"},"title":"Apache James: WebAdmin exposed without authentication on official Docker default","problemTypes":[{"descriptions":[{"description":"CWE-1188 Initialization of a Resource with an Insecure Default","lang":"en","cweId":"CWE-1188","type":"CWE"}]}],"source":{"discovery":"UNKNOWN"},"affected":[{"vendor":"Apache Software Foundation","product":"Apache James","versions":[{"status":"affected","version":"0","lessThan":"3.9.1","versionType":"semver"}],"defaultStatus":"unaffected"}],"descriptions":[{"value":"Some docker-compose shipped by the project exposes by default Webadmin REST API publically without proper authentication setup.\nVersion 3.9.1 onward sets a random credential by default on unprotected webadmin endpoints to prevent this while retain convenience.","lang":"en","supportingMedia":[{"type":"text/html","base64":false,"value":"Some docker-compose shipped by the project exposes by default Webadmin REST API publically without proper authentication setup.<br>Version 3.9.1 onward sets a random credential by default on unprotected webadmin endpoints to prevent this while retain convenience."}]}],"references":[{"url":"https://lists.apache.org/thread.html/5zhn007mc3jz691zhb2687ow2n7f0zp0","tags":["vendor-advisory"]}],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"low"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"credits":[{"lang":"en","value":"Wanxin Yin","type":"finder"}],"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/11/06/15"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-11-06T19:05:09.800Z"}}]}}