An authenticated low‑privilege user can send messages to a temporary composite destination whose physical name is a comma‑separated list of real queues. The broker mistakenly treats such destinations as temporary and skips the per‑destination write ACL check, enabling the user to publish to any queue in the list without proper authorization. This flaw permits unauthorized data publication, which can lead to data leakage, tampering, or service disruption.

Apache ActiveMQ, including the Broker and All distributions, are affected. Versions before 5.19.9 and all 6.0.0 releases before 6.2.8 contain the vulnerability; the fix is included in 5.19.9, 6.2.8, and 6.3.0.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild. The issue is not listed in the CISA KEV catalog. Bypassing the ACL requires an authenticated low‑privilege connection to the broker, making the attack vector an authenticated local or remote user with basic permissions. No arbitrary code execution is possible, but the ability to send messages to arbitrary destinations can still compromise confidentiality and integrity of data transmitted through those queues.