RabbitMQ versions 4.2.0 to 4.2.8 and 4.3.0 to 4.3.2 contain a missing authorization check in the AMQP 1.0 management exchange.declare operation. Specifically, the PUT /exchanges/:name endpoint checks only the configure permission on the declared exchange but does not verify read or write permissions on the alternate exchange argument. This omission allows a user who has configure permission on an exchange to route unroutable messages into an alternate exchange they do not have write permission for. The bug is confirmed as a missing permission check rather than intentional behavior, and it is fixed in versions 4.2.9 and 4.3.3.

An attacker with configure permission on at least one exchange but lacking write permission on the target alternate exchange can misuse the alternate exchange feature to route messages improperly. This could lead to unauthorized message routing within the RabbitMQ broker, potentially impacting message flow control and security boundaries within the messaging infrastructure. The CVSS 4.8 score reflects a medium severity with network attack vector and partial privileges required.

This vulnerability is fixed in RabbitMQ versions 4.2.9 and 4.3.3. Users should upgrade to at least these versions to remediate the issue. No additional mitigation actions are indicated by the vendor advisory.