This vulnerability exposes a fundamental flaw in ActiveMQ's authorization model: the system conflates 'temporary' with 'trusted' when handling composite destinations. A composite destination like temp-queue://queue-a,queue-b,queue-c is treated as a single authorization object. When a low-privilege user creates a temporary composite destination, the ACL check validates access to the composite as a whole — which passes because the user legitimately created it. But the routing layer then decomposes this into individual physical destinations without re-validating authorization for each one. The result: a user with write access only to their own temporary queue can route messages to arbitrary queues across the broker.
This isn't a missing check in the traditional sense — it's a layer inversion. The destination parsing layer decomposes the composite syntax into physical destinations, but the authorization layer evaluates the pre-parsed composite object. These two operations happen at different architectural levels with different security assumptions, and the gap between them is exploitable by design. The low-privilege user doesn't need to exploit a bug in the temporary destination feature; they just need to use it exactly as documented.
The CVSS of 6.5 is misleading. Bypassing write ACLs to arbitrary queues with an authenticated account is functionally equivalent to granting that user admin-level write access across the entire broker. The CVSS reflects the technical mechanism, not the operational blast radius. Treat any broker authorization bypass with a score below 8.0 as a miscalibration when the affected account has any legitimate queue interaction.
For detection: audit logs for authorization-denied events followed immediately by successful message routing to the denied destination. If your broker exposes composite decomposition in logs, the pattern becomes clearer. Without that instrumentation, the practical signal is uglier but viable: look for message traffic to queues that don't appear in any known producer's declared ACL scope. Treat any user with dynamic producer capabilities as a privileged role regardless of declared ACL scope, and implement network-level egress filtering on queue targets — if the routing layer can reach it, the authorization layer should have already decided whether it could.
The deeper question for your assessment: does your ActiveMQ deployment use composite destinations anywhere? If so, audit who can create them and what destinations they can reference. This vulnerability makes the answer to that question urgent.