GHSA-rf99-f9j2-gv3f

Source

https://github.com/advisories/GHSA-rf99-f9j2-gv3f

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-rf99-f9j2-gv3f/GHSA-rf99-f9j2-gv3f.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rf99-f9j2-gv3f

Aliases

CVE-2026-40914

Downstream

CGA (4)

MINI (2)

Published

2026-05-28T15:39:50Z

Modified

2026-09-10T03:50:47Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

Apache Artemis has an Incorrect Authorization issue

Details

A vulnerability exists in Apache Artemis whereby an application using the STOMP protocol with security credentials that grant either the consume or send permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. A user could successfully send a message to an address or consume a message from a queue with a routing-type not supported by the corresponding address when that operation should actually be rejected on the basis that the user doesn't have permission to change the routing-type of the address. Even though the user was already granted permission to send and/or consume messages, they should not be able to augment the routing-type of the address without the createAddress permission.

This issue affects Apache Artemis: from 2.50.0 through 2.53.0; Apache ActiveMQ Artemis: from 2.0.0 through 2.44.0.

Users are recommended to upgrade to version 2.54.0, which fixes the issue.

Database specific

{
    "cwe_ids":  [
        "CWE-863"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-02T13:53:04Z",
    "nvd_published_at":  "2026-05-28T13:16:23Z",
    "severity":  "MODERATE"
}

References

Affected packages

Maven / org.apache.artemis:artemis-stomp-protocol

Package

Name: org.apache.artemis:artemis-stomp-protocol; View open source insights on deps.dev
Purl: pkg:maven/org.apache.artemis/artemis-stomp-protocol

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.50.0

Fixed

2.54.0

Affected versions

2.*

2.50.0

2.51.0

2.52.0

2.53.0

Database specific

last_known_affected_version_range

"<= 2.53.0"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-rf99-f9j2-gv3f/GHSA-rf99-f9j2-gv3f.json"

Maven / org.apache.artemis:artemis-stomp-protocol

Package

Name: org.apache.artemis:artemis-stomp-protocol; View open source insights on deps.dev
Purl: pkg:maven/org.apache.artemis/artemis-stomp-protocol

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.0.0

Last Affected

2.44.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-rf99-f9j2-gv3f/GHSA-rf99-f9j2-gv3f.json"