Apache ActiveMQ Broker versions before 5.19.8 and from 6.0.0 before 6.2.7 contain a missing authorization vulnerability (CWE-862) where temporary destinations, expected to be isolated per connection, can be accessed by other connections. This isolation is only enforced client-side, allowing unauthorized consumption of messages from another connection's temporary destination. The vulnerability is fixed in version 6.2.7.

The vulnerability allows unauthorized connections to consume messages from temporary destinations created by other connections, violating expected isolation and potentially leading to unauthorized information disclosure or message interception. There is no impact on confidentiality or availability reported beyond unauthorized message consumption.

Users should upgrade Apache ActiveMQ Broker to version 6.2.7 or later, where this missing authorization issue is fixed. Patch status is confirmed by the vendor's recommendation to upgrade to 6.2.7. No other mitigation or temporary fix is indicated.