CVE-2026-49877

EUVD-2026-40283
Improper Authorization vulnerability in Apache ActiveMQ.

An authenticated low-privilege Web Console user by default can access /admin/* paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to only admins.
This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7.

Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 52.78%
Affected Products (NVD)
VendorProductVersion
apacheactivemq
𝑥
< 5.19.8
apacheactivemq
6.0.0 ≤
𝑥
< 6.2.7
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
activemq
bookworm
vulnerable
bookworm (security)
vulnerable
bullseye
vulnerable
bullseye (security)
vulnerable
sid
vulnerable
trixie
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
activemq
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
ignored
resolute
needs-triage
Common Weakness Enumeration
References
https://lists.apache.org/thread/w82vtc3q02j5ot94tnyy1197y3wb98hl
http://www.openwall.com/lists/oss-security/2026/06/29/9