Improper Authorization Vulnerability in Apache ActiveMQ Products
CVE-2026-61487

6.5MEDIUM

Key Information:

Vendor

Apache
Status
Apache ActiveMQ Broker
Apache ActiveMQ All
Apache ActiveMQ
Vendor
CVE Published:
28 July 2026

What is CVE-2026-61487?

An improper authorization vulnerability exists in Apache ActiveMQ products, allowing low-privilege authenticated users to bypass write access control lists (ACLs). By exploiting this flaw, malicious users can publish messages to destinations included in a comma-separated composite name of real queues, without the required permissions. The issue primarily arises from the authorization checks being skipped for temporary composite destinations. This affects various versions of Apache ActiveMQ Broker, Apache ActiveMQ All, and Apache ActiveMQ, necessitating users to update to the recommended versions 5.19.9, 6.2.8, or 6.3.0 to mitigate the risk.

Affected Version(s)

Apache ActiveMQ 0 < 5.19.9

Apache ActiveMQ 6.0.0 < 6.2.8

Apache ActiveMQ All 0 < 5.19.9

References

https://lists.apache.org/thread/6rwn6cq65dy4lhmsmjf2bxnhb...
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Claude and Ada Logics
.