GHSA-cpw7-g3p5-qrfqMediumCVSS 4.3

Apache ActiveMQ server has an incomplete authorization workflow

Published
June 1, 2026
Last Modified
July 9, 2026

🔗 CVE IDs covered (1)

CVE-2026-46605 →

📋 Description

Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions.

This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.

Users are recommended to upgrade to version v6.2.6 or v5.19.7, which fixes the issue.

🎯 Affected products2

  • maven/org.apache.activemq:apache-activemq:< 5.19.7
  • maven/org.apache.activemq:apache-activemq:>= 6.0.0, < 6.2.6

🔗 References (4)