ghsa-f892-4h9f-j7g9

{
  "affected": [
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-f892-4h9f-j7g9/GHSA-f892-4h9f-j7g9.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.activemq:apache-activemq",
        "purl": "pkg:maven/org.apache.activemq/apache-activemq"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.19.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.1.1",
        "4.1.2",
        "5.0.0",
        "5.1.0",
        "5.10.0",
        "5.10.1",
        "5.10.2",
        "5.11.0",
        "5.11.1",
        "5.11.2",
        "5.11.3",
        "5.11.4",
        "5.12.0",
        "5.12.1",
        "5.12.2",
        "5.12.3",
        "5.13.0",
        "5.13.1",
        "5.13.2",
        "5.13.3",
        "5.13.4",
        "5.13.5",
        "5.14.0",
        "5.14.1",
        "5.14.2",
        "5.14.3",
        "5.14.4",
        "5.14.5",
        "5.15.0",
        "5.15.1",
        "5.15.10",
        "5.15.11",
        "5.15.12",
        "5.15.13",
        "5.15.14",
        "5.15.15",
        "5.15.16",
        "5.15.2",
        "5.15.3",
        "5.15.4",
        "5.15.5",
        "5.15.6",
        "5.15.7",
        "5.15.8",
        "5.15.9",
        "5.16.0",
        "5.16.1",
        "5.16.2",
        "5.16.3",
        "5.16.4",
        "5.16.5",
        "5.16.6",
        "5.16.7",
        "5.16.8",
        "5.17.0",
        "5.17.1",
        "5.17.2",
        "5.17.3",
        "5.17.4",
        "5.17.5",
        "5.17.6",
        "5.17.7",
        "5.18.0",
        "5.18.1",
        "5.18.2",
        "5.18.3",
        "5.18.4",
        "5.18.5",
        "5.18.6",
        "5.18.7",
        "5.19.0",
        "5.19.1",
        "5.19.2",
        "5.19.3",
        "5.19.4",
        "5.19.5",
        "5.19.6",
        "5.19.7",
        "5.2.0",
        "5.3.0",
        "5.3.1",
        "5.3.2",
        "5.4.0",
        "5.4.1",
        "5.4.2",
        "5.4.3",
        "5.5.0",
        "5.5.1",
        "5.6.0",
        "5.7.0",
        "5.8.0",
        "5.9.0",
        "5.9.1"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-f892-4h9f-j7g9/GHSA-f892-4h9f-j7g9.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.activemq:apache-activemq",
        "purl": "pkg:maven/org.apache.activemq/apache-activemq"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.2.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "6.0.0",
        "6.0.1",
        "6.1.0",
        "6.1.1",
        "6.1.2",
        "6.1.3",
        "6.1.4",
        "6.1.5",
        "6.1.6",
        "6.1.7",
        "6.1.8",
        "6.2.0",
        "6.2.1",
        "6.2.2",
        "6.2.3",
        "6.2.4",
        "6.2.5",
        "6.2.6"
      ]
    }
  ],
  "aliases": [
    "BIT-activemq-2026-49877",
    "CVE-2026-49877"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-04T15:57:33Z",
    "nvd_published_at": "2026-06-30T11:16:29Z",
    "severity": "HIGH"
  },
  "details": "Improper Authorization vulnerability in Apache ActiveMQ.\n\nAn authenticated low-privilege Web Console user by default can access /admin/* paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to only admins.\nThis issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7.\n\nUsers are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.",
  "id": "GHSA-f892-4h9f-j7g9",
  "modified": "2026-11-04T16:25:37.790058903Z",
  "published": "2026-06-30T12:31:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49877"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/activemq/pull/2074"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/activemq/commit/085efea55270aca20f2158c0a91a0f4a9fe497f4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/activemq/commit/1eda6a164f38b6eb1a90ffb1462a95cd9ad121e9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/activemq/commit/be70a7efa1efcb6bdb9988f736245b06d39a91e4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/activemq"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/activemq/releases/tag/activemq-5.19.8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/activemq/releases/tag/activemq-6.2.7"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/w82vtc3q02j5ot94tnyy1197y3wb98hl"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/06/29/9"
    }
  ],
  "schema_version": "1.9.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Apache ActiveMQ Improper Authorization vulnerability"
}