This vulnerability arises from a missing permission check when an AMQP 1.0 exchange is declared through the management interface, allowing a user with configure rights on an exchange to route unroutable messages into an alternate exchange without having write permission on that alternate exchange. The flaw permits unauthorized routing of messages, potentially exposing sensitive data or enabling denial of service if the alternate exchange is misconfigured. The weakness is a classic example of improper authorization (CWE-862).

The issue affects RabbitMQ Server releases from 4.2.0 through 4.2.8 and from 4.3.0 through 4.3.2. Versions 4.2.9 and 4.3.3 contain fixes that restore the missing permission check for the alternate-exchange argument.

The CVSS score of 4.8 indicates a moderate impact; the EPSS score is not available, and the vulnerability is not listed in CISA KEV. The likely attack path involves sending a declaration request to the AMQP 1.0 management endpoint, which bypasses the write permission check for alternate exchanges; the attacker needs only configure rights on an exchange but does not require write rights on the target alternate exchange. While exploitation requires some level of access, the moderate CVSS and absence of public exploitation data suggest a lower likelihood of immediate widespread impact.