The flaw consists of incomplete authorization checks during destination removal in Apache ActiveMQ. As a result, any authenticated user can delete existing queues or topics even when lacking proper rights, potentially disrupting message routing, causing data loss, or leading to denial of service.

Affected products include Apache ActiveMQ Broker, Apache ActiveMQ All, and Apache ActiveMQ. The vulnerability is present in all releases older than 5.19.7 and older than 6.2.6, including versions from 6.0.0 until the specified limits.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of <1% suggests a low probability of exploitation. The flaw can be exercised by anyone who can authenticate to the broker, making it exploitable in environments where credentials are compromised or shared. Although the vulnerability is not listed in CISA’s KEV catalog, its impact on critical messaging services and the lack of strong authorization imply a high potential for exploitation if left unpatched.