This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-49877 →

DEBIAN-CVE-2026-49877

Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console user by default can access /admin/* paths in the...

Original description

The description as published by the source.

Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console user by default can access /admin/* paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to only admins. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 activemq

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 activemq

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

advisory security-tracker.debian.org