CVE-2026-25767

Katalog CVE

CVSS 8.1 · High EPSS 0,49%

Kerentanan Incorrect Authorization pada 84codes lavinmq. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

LavinMQ is a high-performance message queue & streaming server. Before 2.6.8, an authenticated user, with the “Policymaker” tag, could create shovels bypassing access controls. an authenticated user with the "Policymaker" management tag could exploit it to read messages from vhosts they are not authorized to access or publish messages to vhosts they are not authorized to access. This vulnerability is fixed in 2.6.8.

Rincian

Terbit di NVD

12 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/cloudamqp/lavinmq/security/advisories/GHSA-wh37-6vrr-r9wg mitigasi · advisory vendor
• https://github.com/cloudamqp/lavinmq/commit/3a83e5894495b60c7c32a79c3dbc9bd9fa237d9a patch
• https://github.com/cloudamqp/lavinmq/commit/be03da31f3db1a2552f7094ff58e953ef50cdc82 patch
• https://github.com/cloudamqp/lavinmq/pull/1670 issue tracking · patch
• https://github.com/cloudamqp/lavinmq/pull/1687 issue tracking · patch