CVE-2026-25767

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25767", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-05T18:35:52.358Z", "datePublished": "2026-02-12T19:49:49.516Z", "dateUpdated": "2026-02-12T20:52:24.629Z"}, "containers": {"cna": {"title": "LavinMQ has incomplete shovel configuration validation", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/cloudamqp/lavinmq/security/advisories/GHSA-wh37-6vrr-r9wg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/cloudamqp/lavinmq/security/advisories/GHSA-wh37-6vrr-r9wg"}, {"name": "https://github.com/cloudamqp/lavinmq/pull/1670", "tags": ["x_refsource_MISC"], "url": "https://github.com/cloudamqp/lavinmq/pull/1670"}, {"name": "https://github.com/cloudamqp/lavinmq/pull/1687", "tags": ["x_refsource_MISC"], "url": "https://github.com/cloudamqp/lavinmq/pull/1687"}, {"name": "https://github.com/cloudamqp/lavinmq/commit/3a83e5894495b60c7c32a79c3dbc9bd9fa237d9a", "tags": ["x_refsource_MISC"], "url": "https://github.com/cloudamqp/lavinmq/commit/3a83e5894495b60c7c32a79c3dbc9bd9fa237d9a"}, {"name": "https://github.com/cloudamqp/lavinmq/commit/be03da31f3db1a2552f7094ff58e953ef50cdc82", "tags": ["x_refsource_MISC"], "url": "https://github.com/cloudamqp/lavinmq/commit/be03da31f3db1a2552f7094ff58e953ef50cdc82"}], "affected": [{"vendor": "cloudamqp", "product": "lavinmq", "versions": [{"version": "< 2.6.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-12T19:49:49.516Z"}, "descriptions": [{"lang": "en", "value": "LavinMQ is a high-performance message queue & streaming server. Before 2.6.8, an authenticated user, with the \u201cPolicymaker\u201d tag, could create shovels bypassing access controls. an authenticated user with the \"Policymaker\" management tag could exploit it to read messages from vhosts they are not authorized to access or publish messages to vhosts they are not authorized to access. This vulnerability is fixed in 2.6.8."}], "source": {"advisory": "GHSA-wh37-6vrr-r9wg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-12T20:52:07.681102Z", "id": "CVE-2026-25767", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-12T20:52:24.629Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25767", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-05T18:35:52.358Z", "datePublished": "2026-02-12T19:49:49.516Z", "dateUpdated": "2026-02-12T20:52:24.629Z"}, "containers": {"cna": {"title": "LavinMQ has incomplete shovel configuration validation", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/cloudamqp/lavinmq/security/advisories/GHSA-wh37-6vrr-r9wg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/cloudamqp/lavinmq/security/advisories/GHSA-wh37-6vrr-r9wg"}, {"name": "https://github.com/cloudamqp/lavinmq/pull/1670", "tags": ["x_refsource_MISC"], "url": "https://github.com/cloudamqp/lavinmq/pull/1670"}, {"name": "https://github.com/cloudamqp/lavinmq/pull/1687", "tags": ["x_refsource_MISC"], "url": "https://github.com/cloudamqp/lavinmq/pull/1687"}, {"name": "https://github.com/cloudamqp/lavinmq/commit/3a83e5894495b60c7c32a79c3dbc9bd9fa237d9a", "tags": ["x_refsource_MISC"], "url": "https://github.com/cloudamqp/lavinmq/commit/3a83e5894495b60c7c32a79c3dbc9bd9fa237d9a"}, {"name": "https://github.com/cloudamqp/lavinmq/commit/be03da31f3db1a2552f7094ff58e953ef50cdc82", "tags": ["x_refsource_MISC"], "url": "https://github.com/cloudamqp/lavinmq/commit/be03da31f3db1a2552f7094ff58e953ef50cdc82"}], "affected": [{"vendor": "cloudamqp", "product": "lavinmq", "versions": [{"version": "< 2.6.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-12T19:49:49.516Z"}, "descriptions": [{"lang": "en", "value": "LavinMQ is a high-performance message queue & streaming server. Before 2.6.8, an authenticated user, with the \u201cPolicymaker\u201d tag, could create shovels bypassing access controls. an authenticated user with the \"Policymaker\" management tag could exploit it to read messages from vhosts they are not authorized to access or publish messages to vhosts they are not authorized to access. This vulnerability is fixed in 2.6.8."}], "source": {"advisory": "GHSA-wh37-6vrr-r9wg", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25767", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-12T20:52:07.681102Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-12T20:52:17.626Z"}}]}}

{"affected": [{"affectedData": [{"product": "lavinmq", "vendor": "cloudamqp", "versions": [{"status": "affected", "version": "< 2.6.8"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:84codes:lavinmq:*:*:*:*:*:*:*:*", "matchCriteriaId": "D27D43CF-66DA-452C-A820-C7302EAB3558", "versionEndExcluding": "2.6.8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LavinMQ is a high-performance message queue & streaming server. Before 2.6.8, an authenticated user, with the \u201cPolicymaker\u201d tag, could create shovels bypassing access controls. an authenticated user with the \"Policymaker\" management tag could exploit it to read messages from vhosts they are not authorized to access or publish messages to vhosts they are not authorized to access. This vulnerability is fixed in 2.6.8."}, {"lang": "es", "value": "LavinMQ es un servidor de cola de mensajes y streaming de alto rendimiento. Antes de la versi\u00f3n 2.6.8, un usuario autenticado, con la etiqueta 'Policymaker', pod\u00eda crear 'shovels' eludiendo los controles de acceso. Un usuario autenticado con la etiqueta de gesti\u00f3n 'Policymaker' podr\u00eda explotarlo para leer mensajes de 'vhosts' a los que no est\u00e1 autorizado a acceder o publicar mensajes en 'vhosts' a los que no est\u00e1 autorizado a acceder. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.6.8."}], "id": "CVE-2026-25767", "lastModified": "2026-06-17T10:25:11.910", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25767", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-12T20:52:07.681102Z", "version": "2.0.3"}}]}, "published": "2026-02-12T20:16:10.623", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/cloudamqp/lavinmq/commit/3a83e5894495b60c7c32a79c3dbc9bd9fa237d9a"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/cloudamqp/lavinmq/commit/be03da31f3db1a2552f7094ff58e953ef50cdc82"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/cloudamqp/lavinmq/pull/1670"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/cloudamqp/lavinmq/pull/1687"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/cloudamqp/lavinmq/security/advisories/GHSA-wh37-6vrr-r9wg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.6.8)"}}], "product": "lavinmq", "vendor": "cloudamqp"}], "analysis": {"en": {"generated_at": "2026-04-18T12:33:09.429931+00:00", "value": {"mitigation_remediation": ["Upgrade LavinMQ to version 2.6.8 or later to obtain the vendor\u2011provided fix.", "Restrict the assignment of the Policymaker tag to trusted administrators and enforce least\u2011privilege principles for management users.", "Enable audit logging for shovel creation and review logs for anomalous policy violations to detect potential misuse."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized access to messages via shovel configuration bypass"}, "threat_synthesis": {"affected_systems": "CloudAMQP\u2019s LavinMQ in versions prior to 2.6.8 is affected. Any installation that permits authenticated users with the Policymaker tag to configure shovels without proper validation of the target virtual host is vulnerable.", "description_and_impact": "The vulnerability arises from incomplete validation of shovel configuration in LavinMQ, allowing an authenticated user with the \u201cPolicymaker\u201d management tag to create shovels that circumvent normal access controls. This flaw enables the user to read or publish messages on virtual hosts they are not authorized to access, effectively granting unauthorized data disclosure and potential data modification. The weakness is classified as CWE\u2011863 and can result in a significant compromise of confidentiality and integrity for affected message streams.", "risk_and_exploitability": "The flaw carries a CVSS score of 8.6, indicating high severity. The EPSS score is less than 1\u202f%, suggesting that, although the vulnerability is theoretically exploitable, it is unlikely to see widespread or automated attacks at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated and to hold the Policymaker tag; the attack vector is internal, leveraging legitimate management credentials to overrun access controls through shovel configuration."}}}}, "created": "2026-02-13T21:29:29.739771+00:00", "updated": "2026-04-18T12:45:45.663052+00:00", "vendors": ["cloudamqp", "cloudamqp$PRODUCT$lavinmq"]}