Moquette selects a client’s last‑will topic when they connect. The broker forwards the will through the publish2Subscribers path, but the canWrite authorization check that normally blocks unauthorized PUBLISH messages is bypassed. The result is that a remote client who connects with anonymous access and assigns a write‑protected topic as its will can cause the broker to inject attacker‑controlled messages to that topic when the client disconnects. This violates confidentiality and integrity and constitutes a form of unauthorized message injection, as described by CWE‑862.

Affected systems are installations of the Moquette MQTT broker supplied by moquette‑io. Versions earlier than 0.18.1 lack the patch that restores the authorization check during will publication. Any build using 0.18.0 or earlier is potentially vulnerable.

The CVSS score of 7.5 indicates high severity. Because the exploit requires a client to connect and publish a will for a protected topic, the attack vector is remote and does not need local privilege. No EPSS data is available, and the vulnerability is not yet listed in the CISA KEV catalog. Attackers can trigger the failure by issuing a CONNECT with last‑will settings for a protected topic and then causing an abnormal disconnect; after that the broker will forward the will to subscribers. Consequently, the risk is significant for deployments that allow anonymous client connections or that have narrow ACLs, especially if sensitive topics are protected.