CVE catalog

CVE-2026-61487

Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypass a per-destination write ACL by sending to an Acti

[CVE catalog]

Severity: Medium
Published: Jul 27, 2026, 10:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.46% · Oct 25, 2026

Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypass a per-destination write ACL by sending to an ActiveMQ temporary composite destination whose physical name is a comma-separated composite of real queues. This allows publishing messages to any of the destinations in the list without proper write ACL permissions because the authorization check is bypassed due to the composite destination being marked as temporary. This issue affects Apache ActiveMQ Broker: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ All: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ: before 5.19.9, from 6.0.0 before 6.2.8. Users are recommended to upgrade to version 5.19.9, 6.2.8 or 6.3.0, which fixes the issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	activemq	sid	`5.17.6+dfsg-2`	vulnerable
Debian	activemq	trixie	`5.17.6+dfsg-2`	vulnerable
Debian	activemq	bookworm	`5.17.2+dfsg-2+deb12u1`	vulnerable
Debian	activemq	bookworm-security	`5.17.2+dfsg-2+deb12u1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	activemq	source	sid	`(unfixed)`	not yet assigned	Not reported	[1144412]
Debian	activemq	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1144412]
Debian	activemq	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1144412]

[Debian bug #1144412]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[activemq]Affected
Details (4)
- 5.17.2+dfsg-2+deb12u1 · all · bookworm
  Affected
  nvd · activemq · debian · bookworm; nvd · activemq · debian · 12
- 5.17.2+dfsg-2+deb12u1 · all · bookworm
  Affected
  nvd · activemq · debian · bookworm; nvd · activemq · debian · 12
- 5.17.2+dfsg-2+deb12u1 · all · bookworm-security
  Affected
  nvd · activemq · debian · bookworm; nvd · activemq · debian · 12
- 5.17.2+dfsg-2+deb12u1 · all · bookworm-security
  Affected
  nvd · activemq · debian · bookworm; nvd · activemq · debian · 12
[libactivemq-java]Affected
Source package: [activemq]
Details (4)
- 5.17.2+dfsg-2+deb12u1 · all · bookworm
  Affected
  nvd · activemq · debian · bookworm; nvd · activemq · debian · 12
- 5.17.2+dfsg-2+deb12u1 · all · bookworm
  Affected
  nvd · activemq · debian · bookworm; nvd · activemq · debian · 12
- 5.17.2+dfsg-2+deb12u1 · all · bookworm-security
  Affected
  nvd · activemq · debian · bookworm; nvd · activemq · debian · 12
- 5.17.2+dfsg-2+deb12u1 · all · bookworm-security
  Affected
  nvd · activemq · debian · bookworm; nvd · activemq · debian · 12

[Debian 13 (Trixie)]

[activemq]Affected
Details (2)
- 5.17.6+dfsg-2 · all · trixie
  Affected
  nvd · activemq · debian · 13
- 5.17.6+dfsg-2 · all · trixie
  Affected
  nvd · activemq · debian · 13
[libactivemq-java]Affected
Source package: [activemq]
Details (2)
- 5.17.6+dfsg-2 · all · trixie
  Affected
  nvd · activemq · debian · 13
- 5.17.6+dfsg-2 · all · trixie
  Affected
  nvd · activemq · debian · 13

Observed: Oct 23, 2026, 9:43:14 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]