Skip to content
CVE PROGRAM SOURCE RECORD4.3 Medium

CVE-2026-46605

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions. This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version v6.2.6 or v5.19.7, which fixes the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache ActiveMQ Broker

Default version status: unaffected

  • 0 to < 5.19.7affected
  • 6.0.0 to < 6.2.6affected

Apache Software Foundation Apache ActiveMQ All

Default version status: unaffected

  • 0 to < 5.19.7affected
  • 6.0.0 to < 6.2.6affected

Apache Software Foundation Apache ActiveMQ

Default version status: unaffected

  • 0 to < 5.19.7affected
  • 6.0.0 to < 6.2.6affected

References