What is GHSA-99qx-5qqr-4j95?

GHSA-99qx-5qqr-4j95 is a security advisory published by GitHub Security Advisories with High severity. Apache ActiveMQ has an Incorrect Default Permissions vulnerability

Which CVE IDs does GHSA-99qx-5qqr-4j95 cover?

GHSA-99qx-5qqr-4j95 covers the following CVE IDs: CVE-2026-49157. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-99qx-5qqr-4j95?

GHSA-99qx-5qqr-4j95 has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-99qx-5qqr-4j95?

GHSA-99qx-5qqr-4j95 affects 2 products, including: maven/org.apache.activemq:apache-activemq:\u003c 5.19.7; maven/org.apache.activemq:apache-activemq:\u003e= 6.0.0, \u003c 6.2.6.

GHSA-99qx-5qqr-4j95HighCVSS 8.8

Apache ActiveMQ has an Incorrect Default Permissions vulnerability

Vendor

GitHub Security Advisories

Published

June 1, 2026

Last Modified

July 9, 2026

🔗 CVE IDs covered (1)

CVE-2026-49157 →

📋 Description

Incorrect Default Permissions vulnerability in Apache ActiveMQ.

This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.

The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue.

Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.

🎯 Affected products2

maven/org.apache.activemq:apache-activemq:< 5.19.7
maven/org.apache.activemq:apache-activemq:>= 6.0.0, < 6.2.6

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-49157
https://lists.apache.org/thread/rrcsf6s90hj4tdh89nvkko75q5505rj8
http://www.openwall.com/lists/oss-security/2026/05/31/21
https://github.com/advisories/GHSA-99qx-5qqr-4j95