CVE-2026-46605 — Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal

Description (CNA)

Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions. This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version v6.2.6 or v5.19.7, which fixes the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache ActiveMQ Broker	affected 0 before 5.19.7; affected 6.0.0 before 6.2.6
Apache Software Foundation / Apache ActiveMQ All	affected 0 before 5.19.7; affected 6.0.0 before 6.2.6
Apache Software Foundation / Apache ActiveMQ	affected 0 before 5.19.7; affected 6.0.0 before 6.2.6

CWE

CWE-285

References

https://lists.apache.org/thread/l4lxgr2s73g9pb218f180psfyskf8ldm

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/05/31/20

CISA-ADP

No English description supplied.

No references supplied.