CVE-2026-32642

Incorrect Authorization (CWE-863) vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application using the OpenWire protocol attempts to create a non-durable JMS topic subscription on an address that doesn't exist with an authenticated user which has the "createDurableQueue" permission but does not have the "createAddress" permission and address auto-creation is disabled. In this circumstance, a temporary address will be created whereas the attempt to create the non-durable subscription should instead fail since the user is not authorized to create the corresponding address. When the OpenWire connection is closed the address is removed. This issue affects Apache Artemis: from 2.50.0 through 2.52.0; Apache ActiveMQ Artemis: from 2.0.0 through 2.44.0. Users are recommended to upgrade to version 2.53.0, which fixes the issue.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/4wlrp31ngq2yb54sf4kjb3bl41t4xgtp	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/03/20/2	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:activemq_artemis::::::::
	cpe:2.3:a:apache:artemis::::::::

History

30 Mar 2026, 14:24

Type	Values Removed	Values Added
References	~~() https://lists.apache.org/thread/4wlrp31ngq2yb54sf4kjb3bl41t4xgtp -~~	() https://lists.apache.org/thread/4wlrp31ngq2yb54sf4kjb3bl41t4xgtp - Mailing List, Vendor Advisory
References	~~() http://www.openwall.com/lists/oss-security/2026/03/20/2 -~~	() http://www.openwall.com/lists/oss-security/2026/03/20/2 - Mailing List, Third Party Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.3
CPE		cpe:2.3:a:apache:activemq_artemis:::::::: cpe:2.3:a:apache:artemis::::::::
First Time		Apache artemis Apache activemq Artemis Apache

Information

Published : 2026-03-24 08:16

Updated : 2026-03-30 14:24

NVD link : CVE-2026-32642

Mitre link : CVE-2026-32642

CVE.ORG link : CVE-2026-32642

JSON object : View

Products Affected

apache

activemq_artemis
artemis

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-32642", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security@apache.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-03-24T08:16:01.430", "references": [{"url": "https://lists.apache.org/thread/4wlrp31ngq2yb54sf4kjb3bl41t4xgtp", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/03/20/2", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Incorrect Authorization (CWE-863)\u00a0vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application using the OpenWire protocol attempts to create a non-durable JMS topic subscription on an address that doesn't exist with an authenticated user which has the \"createDurableQueue\" permission but does not have the \"createAddress\" permission and address auto-creation is disabled. In this circumstance, a temporary address will be created whereas the attempt to create the non-durable subscription should instead fail since the user is not authorized to create the corresponding address. When the OpenWire connection is closed the address is removed.\n\nThis issue affects Apache Artemis: from 2.50.0 through 2.52.0; Apache ActiveMQ Artemis: from 2.0.0 through 2.44.0.\n\nUsers are recommended to upgrade to version 2.53.0, which fixes the issue."}, {"lang": "es", "value": "Vulnerabilidad de Autorizaci\u00f3n Incorrecta (CWE-863) en Apache Artemis, Apache ActiveMQ Artemis existe cuando una aplicaci\u00f3n que utiliza el protocolo OpenWire intenta crear una suscripci\u00f3n a un tema JMS no duradera en una direcci\u00f3n que no existe con un usuario autenticado que tiene el permiso 'createDurableQueue' pero no tiene el permiso 'createAddress' y la creaci\u00f3n autom\u00e1tica de direcciones est\u00e1 deshabilitada. En esta circunstancia, se crear\u00e1 una direcci\u00f3n temporal mientras que el intento de crear la suscripci\u00f3n no duradera deber\u00eda fallar en su lugar ya que el usuario no est\u00e1 autorizado a crear la direcci\u00f3n correspondiente. Cuando la conexi\u00f3n OpenWire se cierra, la direcci\u00f3n se elimina.\n\nEste problema afecta a Apache Artemis: desde 2.50.0 hasta 2.52.0; Apache ActiveMQ Artemis: desde 2.0.0 hasta 2.44.0.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 2.53.0, que corrige el problema."}], "lastModified": "2026-03-30T14:24:59.710", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:activemq_artemis:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4462260B-0DB8-4148-B8AF-E5CCDEF8BC2D", "versionEndIncluding": "2.44.0", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:apache:artemis:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7D1E5DB1-E198-4351-9807-0E14D0A6138D", "versionEndExcluding": "2.53.0", "versionStartIncluding": "2.50.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}