CVE-2026-25767

LavinMQ is a high-performance message queue & streaming server. Before 2.6.8, an authenticated user, with the “Policymaker” tag, could create shovels bypassing access controls. an authenticated user with the "Policymaker" management tag could exploit it to read messages from vhosts they are not authorized to access or publish messages to vhosts they are not authorized to access. This vulnerability is fixed in 2.6.8.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/cloudamqp/lavinmq/commit/3a83e5894495b60c7c32a79c3dbc9bd9fa237d9a	Patch
https://github.com/cloudamqp/lavinmq/commit/be03da31f3db1a2552f7094ff58e953ef50cdc82	Patch
https://github.com/cloudamqp/lavinmq/pull/1670	Issue Tracking Patch
https://github.com/cloudamqp/lavinmq/pull/1687	Issue Tracking Patch
https://github.com/cloudamqp/lavinmq/security/advisories/GHSA-wh37-6vrr-r9wg	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:84codes:lavinmq:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-02-12 20:16

Updated : 2026-06-17 10:25

NVD link : CVE-2026-25767

Mitre link : CVE-2026-25767

CVE.ORG link : CVE-2026-25767

JSON object : View

Products Affected

84codes

lavinmq

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-25767", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25767", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-12T20:52:07.681102Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "cloudamqp", "product": "lavinmq", "versions": [{"status": "affected", "version": "< 2.6.8"}]}]}], "published": "2026-02-12T20:16:10.623", "references": [{"url": "https://github.com/cloudamqp/lavinmq/commit/3a83e5894495b60c7c32a79c3dbc9bd9fa237d9a", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/cloudamqp/lavinmq/commit/be03da31f3db1a2552f7094ff58e953ef50cdc82", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/cloudamqp/lavinmq/pull/1670", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/cloudamqp/lavinmq/pull/1687", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/cloudamqp/lavinmq/security/advisories/GHSA-wh37-6vrr-r9wg", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "LavinMQ is a high-performance message queue & streaming server. Before 2.6.8, an authenticated user, with the \u201cPolicymaker\u201d tag, could create shovels bypassing access controls. an authenticated user with the \"Policymaker\" management tag could exploit it to read messages from vhosts they are not authorized to access or publish messages to vhosts they are not authorized to access. This vulnerability is fixed in 2.6.8."}, {"lang": "es", "value": "LavinMQ es un servidor de cola de mensajes y streaming de alto rendimiento. Antes de la versi\u00f3n 2.6.8, un usuario autenticado, con la etiqueta 'Policymaker', pod\u00eda crear 'shovels' eludiendo los controles de acceso. Un usuario autenticado con la etiqueta de gesti\u00f3n 'Policymaker' podr\u00eda explotarlo para leer mensajes de 'vhosts' a los que no est\u00e1 autorizado a acceder o publicar mensajes en 'vhosts' a los que no est\u00e1 autorizado a acceder. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.6.8."}], "lastModified": "2026-06-17T10:25:11.910", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:84codes:lavinmq:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D27D43CF-66DA-452C-A820-C7302EAB3558", "versionEndExcluding": "2.6.8"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}