---
id: CVE-2026-49877
aliases:
  - GHSA-f892-4h9f-j7g9
title: Apache ActiveMQ Improper Authorization vulnerability
summary: Apache ActiveMQ Improper Authorization vulnerability
severity: high
cvss: 8.1
cwe:
  - CWE-285
vendor: apache
product: 'org.apache.activemq:apache-activemq'
ecosystem: maven
affected:
  - 'org.apache.activemq:apache-activemq < 5.19.8'
  - 'org.apache.activemq:apache-activemq >= 6.0.0, < 6.2.7'
patched:
  - 'org.apache.activemq:apache-activemq 5.19.8'
  - 'org.apache.activemq:apache-activemq 6.2.7'
published: '2026-06-30'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T15:57:35Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-f892-4h9f-j7g9'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-49877'
  - url: 'https://lists.apache.org/thread/w82vtc3q02j5ot94tnyy1197y3wb98hl'
  - url: 'http://www.openwall.com/lists/oss-security/2026/06/29/9'
  - url: 'https://github.com/apache/activemq/pull/2074'
  - url: >-
      https://github.com/apache/activemq/commit/085efea55270aca20f2158c0a91a0f4a9fe497f4
  - url: >-
      https://github.com/apache/activemq/commit/1eda6a164f38b6eb1a90ffb1462a95cd9ad121e9
  - url: >-
      https://github.com/apache/activemq/commit/be70a7efa1efcb6bdb9988f736245b06d39a91e4
  - url: 'https://github.com/apache/activemq/releases/tag/activemq-5.19.8'
  - url: 'https://github.com/apache/activemq/releases/tag/activemq-6.2.7'
  - url: 'https://github.com/advisories/GHSA-f892-4h9f-j7g9'
tags:
  - ghsa
  - maven
epss: 0.00513
epssPercentile: 0.43895
ingestedAt: '2026-11-04T16:18:35.578Z'
---

## Overview

Improper Authorization vulnerability in Apache ActiveMQ.

An authenticated low-privilege Web Console user by default can access /admin/* paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to only admins.
This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7.

Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.

## Affected packages

- `org.apache.activemq:apache-activemq < 5.19.8`
- `org.apache.activemq:apache-activemq >= 6.0.0, < 6.2.7`

## Remediation

Upgrade to a patched release:

- `org.apache.activemq:apache-activemq 5.19.8`
- `org.apache.activemq:apache-activemq 6.2.7`