Skip to main content

Missing Authorization

CVE-2026-54475

High
7.5/10

Summary

Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic temporary destinations are expected to be isolated to the connection that created them. The isolation can be broken as this is only checked in the client, allowing adifferent connection to consume from another connection's temporary destination. This issue affects Apache ActiveMQ Broker: prior to 5.19.8, from 6.0.0 prior to 6.2.7; Apache ActiveMQ All: prior to 5.19.8, from 6.0.0 prior to 6.2.7; Apache ActiveMQ: prior to 5.19.8, from 6.0.0 prior to 6.2.7. Users are recommended to upgrade to version 6.2.7, which fixes the issue.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • NONE

CWE-862 - Missing Authorization

The missing authorization vulnerability occurs when a software program allows users to access privileged parts of the program without verifying the user credentials. Impact of such a vulnerability depends on the resources employed by the software, ranging from account takeover to sensitive information exposure, denial of service, and complete system takeover.

References

Advisory Timeline

  • Published