CVE-2026-46605

published 2026-06-01

CVE-2026-46605: Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with…

medium 4.3 CVSS 3.1

AV N AC L PR L UI N S U C N I N A L

Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions.

This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.

Users are recommended to upgrade to version v6.2.6 or v5.19.7, which fixes the issue.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
apache	activemq	< 5.19.7	5.19.7
apache	activemq	>= 6.0.0 < 6.2.6	6.2.6
apache	activemq_broker	< 5.19.7	5.19.7
apache	activemq_broker	>= 6.0.0 < 6.2.6	6.2.6
apache_software_foundation	apache_activemq	< 5.19.7	5.19.7
apache_software_foundation	apache_activemq	>= 6.0.0 < 6.2.6	6.2.6
apache_software_foundation	apache_activemq_all	< 5.19.7	5.19.7
apache_software_foundation	apache_activemq_all	>= 6.0.0 < 6.2.6	6.2.6
apache_software_foundation	apache_activemq_broker	< 5.19.7	5.19.7
apache_software_foundation	apache_activemq_broker	>= 6.0.0 < 6.2.6	6.2.6

CWE-285