SB20260824164 - Improper authorization in Apache ActiveMQ

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Authorization (CVE-ID: CVE-2026-61487)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass authorization and publish messages to unauthorized destinations.

The vulnerability exists due to improper authorization in ActiveMQ destination authorization handling when sending to a temporary composite destination whose physical name is a comma-separated composite of real queues. A remote user can send a message to a crafted temporary composite destination to bypass authorization and publish messages to unauthorized destinations.

The issue affects per-destination write ACL enforcement for temporary composite destinations.

Remediation

Install update from vendor's website.

References

• https://lists.apache.org/api/email.lua?id=3xgg0vck6gngjt3w6rgmb3zto1bgog73
• https://activemq.apache.org/