Not rated
CVE-2026-49877 Improper Authorization vulnerability in Apache ActiveMQ
Description
Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console user by default can access /admin/* paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to only admins. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache ActiveMQ 6.0 | 6.0.0 → < 6.2.7 | 6.2.7 |
| Apache ActiveMQ 5.19 | earliest → < 5.19.8 | 5.19.8 |
References
- lists.apache.org lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache ActiveMQ
The 40 CVEs of Apache ActiveMQ →
CVE-2026-108500
Apache ActiveMQ: LDAPAuthorizationMap allows authorization bypass via DN injection
Not rated
CVE-2026-108946
Apache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connection
Not rated
CVE-2026-111822
Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation
Not rated
CVE-2026-111821
Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal
Not rated