A flaw in Apache Artemis’ STOMP handling allows a user with send or consume rights to alter an address’s routing type, even without createAddress authority. This unintended elevation means the user can effectively reconfigure how messages are routed, violating the intended isolation between actions. The weakness stems from insufficient permission checks, allowing routing-type changes for an address that should be immutable from the perspective of the user.

The issue impacts Apache Artemis from versions 2.50.0 through 2.53.0 and Apache ActiveMQ Artemis from 2.0.0 through 2.44.0. Both implementations share the same underlying address configuration logic, so the alteration can occur in any deployment that uses the STOMP protocol and has an address to which send or consume operations are allowed.

The CVSS score of 4.3 indicates a moderate severity; no public exploit is reported. However, the vulnerability represents a privilege escalation that could allow an attacker to redirect or drop messages by changing an address’s routing type. The absence from the CISA KEV catalog suggests no known large‑scale exploitation yet, but the potential to bypass address‑level safeguards warrants prompt action. An attacker would need only a valid STOMP session with send or consume rights, making the attack surface relatively broad.