This vulnerability in Apache ActiveMQ Broker arises because temporary composite destinations are marked in a way that bypasses the usual per-destination write ACL checks. An authenticated user with low privileges can exploit this by sending messages to a temporary composite destination whose physical name is a comma-separated list of real queues. This allows unauthorized message publishing to any queue in the composite list, circumventing intended authorization restrictions. The affected versions include all versions before 5.19.9 and from 6.0.0 up to but not including 6.2.8. The issue is fixed in versions 5.19.9, 6.2.8, and 6.3.0.

An authenticated user with low privileges can bypass write access controls on specific message destinations, allowing unauthorized message publishing. This could lead to unauthorized data injection or message manipulation within the messaging system. The vulnerability does not impact confidentiality or availability but has a high impact on integrity.

Users should upgrade Apache ActiveMQ Broker to version 5.19.9, 6.2.8, or 6.3.0 or later to remediate this vulnerability. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the vendor advisory recommending these fixed versions.