CVE-2026-61487

Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypass a per-destination write ACL by sending to an ActiveMQ temporary composite destination whose physical name is a comma-separated composite of real queues. This allows publishing messages to any of the destinations in the list without proper write ACL permissions because the authorization check is bypassed due to the composite destination being marked as temporary. This issue affects Apache ActiveMQ Broker: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ All: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ: before 5.19.9, from 6.0.0 before 6.2.8. Users are recommended to upgrade to version 5.19.9, 6.2.8 or 6.3.0, which fixes the issue.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/6rwn6cq65dy4lhmsmjf2bxnhbmhkcswz	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/07/27/8	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:activemq::::::::
	cpe:2.3:a:apache:activemq::::::::
	cpe:2.3:a:apache:activemq_all::::::::
	cpe:2.3:a:apache:activemq_all::::::::
	cpe:2.3:a:apache:activemq_broker::::::::
	cpe:2.3:a:apache:activemq_broker::::::::

History

No history.

Information

Published : 2026-07-28 14:16

Updated : 2026-08-05 18:46

NVD link : CVE-2026-61487

Mitre link : CVE-2026-61487

CVE.ORG link : CVE-2026-61487

JSON object : View

Products Affected

apache

activemq
activemq_all
activemq_broker

CWE

CWE-285

Improper Authorization

{"id": "CVE-2026-61487", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-61487", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-28T14:06:57.765807Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache ActiveMQ Broker", "versions": [{"status": "affected", "version": "0", "lessThan": "5.19.9", "versionType": "semver"}, {"status": "affected", "version": "6.0.0", "lessThan": "6.2.8", "versionType": "semver"}], "packageName": "org.apache.activemq:activemq-broker", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache ActiveMQ All", "versions": [{"status": "affected", "version": "0", "lessThan": "5.19.9", "versionType": "semver"}, {"status": "affected", "version": "6.0.0", "lessThan": "6.2.8", "versionType": "semver"}], "packageName": "org.apache.activemq:activemq-all", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache ActiveMQ", "versions": [{"status": "affected", "version": "0", "lessThan": "5.19.9", "versionType": "semver"}, {"status": "affected", "version": "6.0.0", "lessThan": "6.2.8", "versionType": "semver"}], "packageName": "org.apache.activemq:apache-activemq", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2026-07-28T14:16:38.453", "references": [{"url": "https://lists.apache.org/thread/6rwn6cq65dy4lhmsmjf2bxnhbmhkcswz", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/27/8", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.\n\n An authenticated low-privilege user can bypass a per-destination\nwrite ACL by sending to an ActiveMQ temporary composite destination whose physical name is a\ncomma-separated composite of real queues.\u00a0This allows publishing messages to any of the destinations in the list without proper write ACL permissions because the authorization check is bypassed due to the composite destination being marked as temporary.\nThis issue affects Apache ActiveMQ Broker: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ All: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ: before 5.19.9, from 6.0.0 before 6.2.8.\n\nUsers are recommended to upgrade to version 5.19.9, 6.2.8 or 6.3.0, which fixes the issue."}], "lastModified": "2026-08-05T18:46:33.780", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1ACBD165-58B9-4531-B323-ADB0655207DF", "versionEndExcluding": "5.19.9"}, {"criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E7D2CD6F-E7BB-413F-A08D-DAEF40EC0A25", "versionEndExcluding": "6.2.8", "versionStartIncluding": "6.0.0"}, {"criteria": "cpe:2.3:a:apache:activemq_all:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "75A30E55-84D7-4452-9ADE-12F38DFAB3DD", "versionEndExcluding": "5.19.9"}, {"criteria": "cpe:2.3:a:apache:activemq_all:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2F393B16-C307-4ADC-A53E-A8D59C6B6D13", "versionEndExcluding": "6.2.8", "versionStartIncluding": "6.0.0"}, {"criteria": "cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A00EE335-6454-4243-9FB1-A2E3AF86AB66", "versionEndExcluding": "5.19.9"}, {"criteria": "cpe:2.3:a:apache:activemq_broker:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "07B23792-9C71-4904-9E12-810CEB38036A", "versionEndExcluding": "6.2.8", "versionStartIncluding": "6.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}