The reported bug allows an administrator to remove users who have been marked with a protected tag by using the bulk-delete API endpoint. The protected-tag check, which normally prevents deletion of such users, is bypassed because the bulk-delete handler calls the internal deletion function directly, omitting the guard. As a result, privileged service accounts can be maliciously or accidentally removed, undermining configuration stability and potentially disrupting service continuity.

Versions 3.13.0 through 3.13.15, 4.0.20, 4.1.11, and 4.2.6 of RabbitMQ Server are affected. Administrators using these releases should verify their deployment and plan for remediation.

The CVSS score of 2.1 indicates that the vulnerability has low overall severity. With the EPSS score unavailable and no entry in the CISA KEV catalog, the likelihood of widespread exploitation appears low at present. However, because the flaw requires administrator access to the HTTP API, an attacker who already has privileged credentials could use the bulk-delete endpoint to silently expunge protected accounts. In environments where service accounts are critical, this could lead to denial of service or configuration loss even though the vector is limited to authorized users.