CVE-2026-61487

The CVE-2026-61487 vulnerability affects Apache ActiveMQ Broker, ActiveMQ All, and ActiveMQ where an authenticated, low-privilege user can bypass per-destination write ACLs by sending to a temporary composite destination whose physical name is a comma-separated list of real queues. The authorizat...

CVE-2026-61487 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinations

Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypass a per-destination write ACL by sending to an ActiveMQ temporary composite destination whose physical name is a comma-separated composite of real...