GHSA-cpw7-g3p5-qrfq

Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions.

This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.

Users are recommended to upgrade to version v6.2.6 or v5.19.7, which fixes the issue.

Database specific

{
    "cwe_ids": [
        "CWE-285"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-09T21:04:36Z",
    "nvd_published_at": "2026-06-01T09:16:19Z",
    "severity": "MODERATE"
}

References

Affected packages

Maven / org.apache.activemq:apache-activemq

Package

Name: org.apache.activemq:apache-activemq; View open source insights on deps.dev
Purl: pkg:maven/org.apache.activemq/apache-activemq

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

5.19.7

Affected versions

4.*

4.1.1

4.1.2

5.*

5.0.0

5.1.0

5.2.0

5.3.0

5.3.1

5.3.2

5.4.0

5.4.1

5.4.2

5.4.3

5.5.0

5.5.1

5.6.0

5.7.0

5.8.0

5.9.0

5.9.1

5.10.0

5.10.1

5.10.2

5.11.0

5.11.1

5.11.2

5.11.3

5.11.4

5.12.0

5.12.1

5.12.2

5.12.3

5.13.0

5.13.1

5.13.2

5.13.3

5.13.4

5.13.5

5.14.0

5.14.1

5.14.2

5.14.3

5.14.4

5.14.5

5.15.0

5.15.1

5.15.2

5.15.3

5.15.4

5.15.5

5.15.6

5.15.7

5.15.8

5.15.9

5.15.10

5.15.11

5.15.12

5.15.13

5.15.14

5.15.15

5.15.16

5.16.0

5.16.1

5.16.2

5.16.3

5.16.4

5.16.5

5.16.6

5.16.7

5.16.8

5.17.0

5.17.1

5.17.2

5.17.3

5.17.4

5.17.5

5.17.6

5.17.7

5.18.0

5.18.1

5.18.2

5.18.3

5.18.4

5.18.5

5.18.6

5.18.7

5.19.0

5.19.1

5.19.2

5.19.3

5.19.4

5.19.5

5.19.6

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-cpw7-g3p5-qrfq/GHSA-cpw7-g3p5-qrfq.json"

Maven / org.apache.activemq:apache-activemq

Package

Name: org.apache.activemq:apache-activemq; View open source insights on deps.dev
Purl: pkg:maven/org.apache.activemq/apache-activemq

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.0.0

Fixed

6.2.6

Affected versions

6.*

6.0.0

6.0.1

6.1.0

6.1.1

6.1.2

6.1.3

6.1.4

6.1.5

6.1.6

6.1.7

6.1.8

6.2.0

6.2.1

6.2.2

6.2.3

6.2.4

6.2.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-cpw7-g3p5-qrfq/GHSA-cpw7-g3p5-qrfq.json"