Non notée
CVE-2026-49877 Improper Authorization vulnerability in Apache ActiveMQ
Description
Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console user by default can access /admin/* paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to only admins. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache ActiveMQ 6.0 | 6.0.0 → < 6.2.7 | 6.2.7 |
| Apache ActiveMQ 5.19 | premières → < 5.19.8 | 5.19.8 |
Références
- lists.apache.org lists.apache.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache ActiveMQ
Les 40 CVE de Apache ActiveMQ →
CVE-2026-108500
Apache ActiveMQ: LDAPAuthorizationMap allows authorization bypass via DN injection
Non notée
CVE-2026-108946
Apache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connection
Non notée
CVE-2026-111822
Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation
Non notée
CVE-2026-111821
Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal
Non notée