{"id":"CVE-2026-49877","kind":"vulnerability","aliases":["CVE-2026-49877","GHSA-f892-4h9f-j7g9"],"related":[],"title":"Apache ActiveMQ Improper Authorization vulnerability","description":"Improper Authorization vulnerability in Apache ActiveMQ.\n\nAn authenticated low-privilege Web Console user by default can access /admin/* paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to only admins.\nThis issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7.\n\nUsers are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.","summary":"Apache ActiveMQ's default Jetty settings did not restrict /admin/* paths in the Web Console to administrators. An authenticated low-privilege web console user can therefore reach administrative pages they should not see.","severity":"high","cvss":8.1,"epss":0.00513,"exploited":false,"exploited_at":null,"products":[{"name":"org.apache.activemq:apache-activemq","fixed":["5.19.8"],"affected":"< 5.19.8","ecosystem":"maven"},{"name":"org.apache.activemq:apache-activemq","fixed":["6.2.7"],"affected":">= 6.0.0, < 6.2.7","ecosystem":"maven"},{"name":"apache activemq","fixed":["5.19.8"],"affected":"< 5.19.8","ecosystem":"vendor"},{"name":"apache activemq","fixed":["6.2.7"],"affected":">= 6.0.0, < 6.2.7","ecosystem":"vendor"}],"ecosystems":["maven","vendor"],"tags":["activemq","cwe-285","java","jetty","package","self-hosted"],"not_affected_if":["admin-only-users","fixed-version","no-web-console"],"how_to_check":"- Check the ActiveMQ version with `activemq --version` or the version in the broker's lib directory, and compare it with the affected ranges.\n- Confirm whether the Web Console is enabled on the broker and whether low-privilege user accounts exist in its authentication configuration.","fix":"- Apache ActiveMQ `5.19.8` for the 5.x line (affected before 5.19.8)\n- Apache ActiveMQ `6.2.7` for the 6.x line (affected from 6.0.0 before 6.2.7)","status":"open","published_at":"2026-06-30T11:16:29+00:00","first_seen_at":"2026-11-04T15:58:41+00:00","triaged_at":"2026-11-04T15:59:30+00:00","updated_at":"2026-11-04T16:28:16+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-04T15:59:30Z","model":"claude-haiku-5-5","output":{"fix":"- Apache ActiveMQ `5.19.8` for the 5.x line (affected before 5.19.8)\n- Apache ActiveMQ `6.2.7` for the 6.x line (affected from 6.0.0 before 6.2.7)","reach":"network","title":"Apache ActiveMQ: low-privilege web console users reach admin pages","impact":"medium","summary":"Apache ActiveMQ's default Jetty settings did not restrict /admin/* paths in the Web Console to administrators. An authenticated low-privilege web console user can therefore reach administrative pages they should not see.","audience":"businesses","category":"package","nicknames":[],"who_cares":["activemq","java","jetty","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"low-privilege console user reads or changes admin-only pages","analyst_note":"","how_to_check":"- Check the ActiveMQ version with `activemq --version` or the version in the broker's lib directory, and compare it with the affected ranges.\n- Confirm whether the Web Console is enabled on the broker and whether low-privilege user accounts exist in its authentication configuration.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","no-web-console","admin-only-users"],"who_is_affected":"Brokers running Apache ActiveMQ 5.x before 5.19.8 or 6.x before 6.2.7 with the Web Console enabled and non-admin user accounts. The attacker needs valid credentials for a low-privilege console user. Teams on fixed versions, or with no such users, are not exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000736,"input_tokens":4356,"output_tokens":600,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':7A,15A '-285':31B '-49877':8A,16A '/admin':47B,90C '4h9f':12A '5.19.8':115C,129C '6.0.0':117C '6.2.7':119C,127C 'access':89C 'activemq':2A,20A,24A,26A,28A,29B,39B,77C,113C 'admin':108C 'administr':54B,66B 'affect':111C 'apach':1A,38B,76C,112C 'apache':19A,23A,25A,27A 'apache-activemq':18A,22A 'authent':56B,79C 'author':4A,73C 'consol':52B,61B,84C,95C 'cve':6A,14A 'cwe':30B 'default':41B,87C,97C 'f892':11A 'fix':131C 'ghsa':10A 'ghsa-f892-4h9f-j7g9':9A 'host':37B 'improp':3A,72C 'incorrect':100C 'issu':110C,133C 'j7g9':13A 'java':32B 'jetti':33B,42B,98C 'limit':103C 'low':58B,81C 'low-privileg':57B,80C 'org.apache.activemq':17A,21A 'packag':34B 'page':67B 'path':48B,91C,105C 'privileg':59B,82C 'reach':65B 'recommend':122C 'restrict':46B 'see':71B 'self':36B 'self-host':35B 'set':43B,99C 'therefor':64B 'upgrad':124C 'user':62B,85C,120C 'version':126C 'vulner':5A,74C 'web':51B,60B,83C,94C","nicknames":[],"mitigations":[],"who_affected":"Brokers running Apache ActiveMQ 5.x before 5.19.8 or 6.x before 6.2.7 with the Web Console enabled and non-admin user accounts. The attacker needs valid credentials for a low-privilege console user. Teams on fixed versions, or with no such users, are not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["activemq","apacheactivemq","orgapacheactivemqapacheactivemq"],"ptokens":["activemq","apache","org"],"labels":["activemq","cwe285","high","java","jetty","maven","package","selfhosted","vendor"],"campaign_type":null,"first_public_at":"2026-06-30T11:16:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-f892-4h9f-j7g9","url":"https://github.com/advisories/GHSA-f892-4h9f-j7g9","severity":"high","published_at":"2026-06-30T12:31:52+00:00","modified_at":"2026-11-04T15:57:35+00:00","first_seen_at":"2026-11-04T15:58:41+00:00","fetched_at":"2026-11-04T16:03:42+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-49877","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49877","severity":null,"published_at":"2026-06-30T11:16:29+00:00","modified_at":"2026-10-25T21:10:00+00:00","first_seen_at":"2026-11-04T16:28:16+00:00","fetched_at":"2026-11-04T16:28:16+00:00","note":null}],"documents":[{"id":68221,"url":"https://github.com/apache/activemq/pull/2074","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68222,"url":"https://github.com/apache/activemq/commit/085efea55270aca20f2158c0a91a0f4a9fe497f4","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68223,"url":"https://github.com/apache/activemq/commit/1eda6a164f38b6eb1a90ffb1462a95cd9ad121e9","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68224,"url":"https://github.com/apache/activemq/commit/be70a7efa1efcb6bdb9988f736245b06d39a91e4","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68016,"url":"https://github.com/apache/activemq/releases/tag/activemq-5.19.8","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":68017,"url":"https://github.com/apache/activemq/releases/tag/activemq-6.2.7","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":68528,"url":"https://lists.apache.org/thread/w82vtc3q02j5ot94tnyy1197y3wb98hl","title":"Vendor advisory: lists.apache.org","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: lists.apache.org"},{"id":68529,"url":"http://www.openwall.com/lists/oss-security/2026/06/29/9","title":"Third-party advisory: www.openwall.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.openwall.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}