The vulnerability arises from incomplete validation of shovel configuration in LavinMQ, allowing an authenticated user with the “Policymaker” management tag to create shovels that circumvent normal access controls. This flaw enables the user to read or publish messages on virtual hosts they are not authorized to access, effectively granting unauthorized data disclosure and potential data modification. The weakness is classified as CWE‑863 and can result in a significant compromise of confidentiality and integrity for affected message streams.

CloudAMQP’s LavinMQ in versions prior to 2.6.8 is affected. Any installation that permits authenticated users with the Policymaker tag to configure shovels without proper validation of the target virtual host is vulnerable.

The flaw carries a CVSS score of 8.6, indicating high severity. The EPSS score is less than 1 %, suggesting that, although the vulnerability is theoretically exploitable, it is unlikely to see widespread or automated attacks at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated and to hold the Policymaker tag; the attack vector is internal, leveraging legitimate management credentials to overrun access controls through shovel configuration.