https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-05T19:23:32.733471+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-111822 CVE-2026-111822 — Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation 2026-11-05T19:23:32.734648+00:00

Affected: Apache Software Foundation Apache ActiveMQ, Apache Software Foundation Apache ActiveMQ Runtime Config

Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config.

After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination, including through a new anonymous producer, while fresh connections and new explicit producers are denied.

This issue affects Apache ActiveMQ: from 6.0.0 before 6.3.3, before 5.19.12; Apache ActiveMQ Runtime Config: from 6.0.0 before 6.3.3, before 5.19.12.

Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue.