Apache ActiveMQ allows temporary destinations, which are intended to be private to the connection that created them. This vulnerability permits another connection to consume messages from a temporary destination of a different client, effectively bypassing the intended isolation and granting unauthorized read access to messages. The weakness lies in missing authorization checks for temporary destination access.

The flaw exists in Apache ActiveMQ Broker releases prior to 5.19.8 and prior to 6.2.7 of the 6.x series, as well as in Apache ActiveMQ All and Apache ActiveMQ Classic versions before 5.19.8 and before 6.2.7. Systems running any of these affected editions are vulnerable.

There is no EPSS score available and the vulnerability is not listed in CISA's KEV catalog, indicating limited publicly known exploitation. The attack would require an adversary to establish an additional connection to the same broker instance, so the practical exploitability depends on network access to the broker. In the absence of a published exploit, the risk is moderate for environments that allow unauthenticated or poorly authenticated connections.