GHSA-f892-4h9f-j7g9

Source

https://github.com/advisories/GHSA-f892-4h9f-j7g9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-f892-4h9f-j7g9/GHSA-f892-4h9f-j7g9.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-f892-4h9f-j7g9

Aliases

Downstream

MINI (4)

Published

2026-06-30T12:31:52Z

Modified

2026-11-04T16:25:37Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

Apache ActiveMQ Improper Authorization vulnerability

Details

Improper Authorization vulnerability in Apache ActiveMQ.

An authenticated low-privilege Web Console user by default can access /admin/* paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to only admins. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7.

Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.

Database specific

{
    "cwe_ids": [
        "CWE-285"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-04T15:57:33Z",
    "nvd_published_at": "2026-06-30T11:16:29Z",
    "severity": "HIGH"
}

References

Affected packages

Maven / org.apache.activemq:apache-activemq

Package

Name: org.apache.activemq:apache-activemq; View open source insights on deps.dev
Purl: pkg:maven/org.apache.activemq/apache-activemq

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

5.19.8

Affected versions

4.*

4.1.1

4.1.2

5.*

5.0.0

5.1.0

5.2.0

5.3.0

5.3.1

5.3.2

5.4.0

5.4.1

5.4.2

5.4.3

5.5.0

5.5.1

5.6.0

5.7.0

5.8.0

5.9.0

5.9.1

5.10.0

5.10.1

5.10.2

5.11.0

5.11.1

5.11.2

5.11.3

5.11.4

5.12.0

5.12.1

5.12.2

5.12.3

5.13.0

5.13.1

5.13.2

5.13.3

5.13.4

5.13.5

5.14.0

5.14.1

5.14.2

5.14.3

5.14.4

5.14.5

5.15.0

5.15.1

5.15.2

5.15.3

5.15.4

5.15.5

5.15.6

5.15.7

5.15.8

5.15.9

5.15.10

5.15.11

5.15.12

5.15.13

5.15.14

5.15.15

5.15.16

5.16.0

5.16.1

5.16.2

5.16.3

5.16.4

5.16.5

5.16.6

5.16.7

5.16.8

5.17.0

5.17.1

5.17.2

5.17.3

5.17.4

5.17.5

5.17.6

5.17.7

5.18.0

5.18.1

5.18.2

5.18.3

5.18.4

5.18.5

5.18.6

5.18.7

5.19.0

5.19.1

5.19.2

5.19.3

5.19.4

5.19.5

5.19.6

5.19.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-f892-4h9f-j7g9/GHSA-f892-4h9f-j7g9.json"

Maven / org.apache.activemq:apache-activemq

Package

Name: org.apache.activemq:apache-activemq; View open source insights on deps.dev
Purl: pkg:maven/org.apache.activemq/apache-activemq

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.0.0

Fixed

6.2.7

Affected versions

6.*

6.0.0

6.0.1

6.1.0

6.1.1

6.1.2

6.1.3

6.1.4

6.1.5

6.1.6

6.1.7

6.1.8

6.2.0

6.2.1

6.2.2

6.2.3

6.2.4

6.2.5

6.2.6

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-f892-4h9f-j7g9/GHSA-f892-4h9f-j7g9.json"