Apache ActiveMQ allows an authenticated attacker to create or target a destination with a crafted name containing LDAP DN special characters such as comma, plus, equals, or backslash. The omission of proper input validation lets the attacker manipulate the LDAP search base used for ACL lookups, effectively bypassing authorization controls. This flaw is a direct input validation error that can expose privileged destinations to unauthorized users.

The vulnerability exists in Apache ActiveMQ versions 6.3.0 through 6.3.2 and 5.19.0 through 5.19.11. Users should upgrade to 6.4.0 or 6.3.3 for the 6.x line and to 5.19.12 for the 5.x line to eliminate the flaw.

No EPSS score is available and the vulnerability is not listed in the KEV catalog, so precise exploitation likelihood cannot be quantified. However, the flaw requires only an authenticated account and permits direct manipulation of ACL lookup logic, which strongly suggests the risk of unauthorized access is significant. It is inferred that the attack vector is primarily internal because no public exploitation has been reported. Overall, the situation warrants urgent remediation.