CVE-2026-49877

EUVD-2026-40283
Improper Authorization vulnerability in Apache ActiveMQ.

An authenticated low-privilege Web Console user by default can access /admin/* paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to only admins.
This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7.

Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
apacheCNA
8.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
apacheactivemq
𝑥
< 5.19.8
CNA
apacheactivemq
6.0.0 ≤
𝑥
< 6.2.7
CNA
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
activemq
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
needs-triage
resolute
needs-triage
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://lists.apache.org/thread/w82vtc3q02j5ot94tnyy1197y3wb98hl
http://www.openwall.com/lists/oss-security/2026/06/29/9