Moquette versions before 0.18.1 incorrectly substitute %c and %u placeholders in ACL pattern rules with client IDs and usernames that may contain MQTT wildcard characters. When a client uses the + or # wildcard in its identity, the substituted ACL filter can become overly permissive, allowing that client to read or write topics belonging to other tenants. In addition, a client using a # identity can generate an invalid ACL filter that triggers a NullPointerException, disrupting session handling for all clients. The CWE-155 and CWE-863 classes indicate flaws in authorization logic and potential permission escalation. The impact is a cross‑tenant authorization bypass accompanied by possible denial of service.

The vulnerable component is the Moquette MQTT broker, any installation of moquette-io:moquette with a version earlier than 0.18.1. Users deploying the broker for multi‑tenant MQTT services are at risk unless the broker is patched or properly configured.

With a CVSS score of 9.6 this vulnerability represents critical severity. The EPSS score is currently not available, which does not diminish its potential for exploitation; attackers can initiate a connection from any remote MQTT client bearing a crafted identity containing wildcards to obtain broad read/write access or to trigger service interruption. The vulnerability is listed as not in the CISA Known Exploited Vulnerabilities catalog, but the combination of a very high severity score and the ease of triggering the flaw through normal client authentication makes it highly exploitable in practice.