In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to ‘#’ or ‘+’. This allows locally or remotely connected clients to access MQTT topics that they do have the rights to. The same issue may be present in third party authentication/access control plugins for Mosquitto.
[
{
"product": "Mosquitto",
"vendor": "Eclipse Foundation",
"versions": [
{
"status": "affected",
"version": "0.15 to 1.4.11 inclusive"
}
]
}
]