Apache James server's JMX management service vulnerable to privilege escalation by local user

HIGH 7.8CVE-2023-26269 · GHSA-w7r6-v4j7-h94w · Published 03/04/2023 · updated 17/06/2026

In short

CVE-2023-26269 is a HIGH (CVSS 7.8) vulnerability affecting org.apache.james:javax-mail-extension, james (apache).
Chance of exploitation in the next 30 days (EPSS): 0.65%, higher than 51.3% of all vulnerabilities.
Fix: update to 3.7.4 or later.

Package	Affected versions	Patched versions
org.apache.james:javax-mail-extension Maven	`< 3.7.4`	`3.7.4`
james apache	`< 3.7.4`	`3.7.4`

Description

Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default. This allows privilege escalation by a malicious local user. Administrators are advised to disable JMX, or set up a JMX password. Note that version 3.7.4 onward will set up a JMX password automatically for Guice users.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2023-26269 · ADVISORY
apache/james-project · PACKAGE
lists.apache.org/thread/2z44rg93pflbjhvbwy3xtz505bx41cbs · WEB
openwall.com/lists/oss-security/2023/04/18/3 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.james:javax-mail-extension

Maven

< 3.7.4

3.7.4

james

apache

< 3.7.4

3.7.4

Description

NVD description