{"id":"CVE-2026-111822","title":"Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation","summary":"Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config.\n\n\n\nAfter the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection op…","severity":"none","vendor":"Apache Software Foundation","product":"org.apache.activemq:apache-activemq","affected":["org.apache.activemq:apache-activemq >= 6.0.0 < 6.3.3","org.apache.activemq:apache-activemq < 5.19.12","org.apache.activemq:activemq-runtime-config >= 6.0.0 < 6.3.3","org.apache.activemq:activemq-runtime-config < 5.19.12"],"published":"2026-11-04","updated":"2026-11-04","sourceUpdated":"2026-11-04T12:11:26.492Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111822","references":[{"url":"https://lists.apache.org/thread/b5gop0kwsm4sr1pgdrfcd14q8hx942j5"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T20:33:06.729Z","slug":"CVE-2026-111822","body":"## Overview\n\nImproper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config.\n\n\n\nAfter the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination, including through a new anonymous producer, while fresh connections and new explicit producers are denied.\n\n\n\nThis issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ Runtime Config: from 6.0.0 before 6.3.3, before 5.19.12.\n\n\n\nUsers are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.\n\n## Affected\n\n- `org.apache.activemq:apache-activemq >= 6.0.0 < 6.3.3`\n- `org.apache.activemq:apache-activemq < 5.19.12`\n- `org.apache.activemq:activemq-runtime-config >= 6.0.0 < 6.3.3`\n- `org.apache.activemq:activemq-runtime-config < 5.19.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}