RabbitMQ allows a user who holds a management tag and virtual‑host access to create super‑streams using the HTTP API without enforcing the necessary configure permissions on the exchange or its partition queues. The missing authorization check occurs in the accept_content/2 function and results in an attacker able to create persistent, cluster‑wide resources that a user normally could only view. This flaw resides in a privilege‑escalation weakness (CWE-862) and enables the creation of an exchange and several bound queues without the required rights.

RabbitMQ server versions earlier than 4.0.22, 4.1.11, 4.2.6, or 4.3.0 are affected when the rabbitmq_stream_management plugin is enabled. A user must have a management tag and virtual‑host access; no individual configure permissions on exchanges or queues are required. Any installation meeting these conditions is vulnerable until patched.

The CVSS score of 2.1 indicates low severity, and an EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the ability to issue HTTP requests to the broker’s management endpoint, likely through the internal network or an exposed management interface. The likely attack vector is inferred to be the broker’s HTTP management interface, as stated in the description that the HTTP handler omits the necessary permission check. Given the low score, the probability of attack is modest, but the privilege escalation potential warrants timely remediation.