GitHub Advisoryadvisory · Maven

GHSA-cpw7-g3p5-qrfq Apache ActiveMQ server has an incomplete authorization workflow

MEDIUM Published 2026-06-01 Modified 2026-07-09 Official page ↗
Aliases
CVE-2026-46605
Ecosystem
Maven
Packages
org.apache.activemq:apache-activemq
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-285
Reviewed
2026-07-09

Affected packages

• Maven org.apache.activemq:apache-activemq: < 5.19.7 → fixed in 5.19.7 • Maven org.apache.activemq:apache-activemq: >= 6.0.0, < 6.2.6 → fixed in 6.2.6

Description

Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions. This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version v6.2.6 or v5.19.7, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2026-46605 Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing… vulnerability

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References