A monitoring user, which should have only read‑only rights, can delete or restart any shovel by sending a DELETE request to the shovel management resource. The flaw arises because the authorization check uses rabbit_mgmt_util:is_authorized_monitor/2, which accepts the monitoring tag, and the delete operation has no further role check. This permits a privileged user to change broker configuration and potentially disrupt message traffic, thus violating integrity and availability. The weakness is classified as CWE-267 (Missing Authorization Checks for Privileged Functions) and CWE-862 (Broken Access Control).

The vulnerability exists in RabbitMQ Server for all releases prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1. Affected installations must have the rabbitmq_shovel and rabbitmq_shovel_management plugins enabled and a user with the monitoring tag role.

The severity is a CVSS score of 6. The EPSS score is < 1%, indicating a very low but nonzero likelihood of exploitation. The issue is not listed in the CISA KEV catalog. Attackers require valid credentials with the monitoring tag; once authenticated they can issue DELETE requests to the shovel endpoints, which removes or restarts the shovel without additional checks. Because no further privilege is required, the exploit can be performed on any vhost for which the attacker has the monitoring tag, posing a moderate risk to broker availability.