CVE-2026-25768

7.1 highEPSS 0.3%

High (7.1) in 84codes lavinmq. EPSS 0.3% chance of exploitation in the next 30 days.

LavinMQ is a high-performance message queue & streaming server. Before 2.6.6, an authenticated user could access metadata in the broker they should not have access to. This vulnerability is fixed in 2.6.6.

Severity

CVSS 4.0

7.1 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 18% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2026-02-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

84codes:lavinmq

References

https://github.com/cloudamqp/lavinmq/commit/e871f8d0a53685f04e39e6410a2421c1f82803b0
https://github.com/cloudamqp/lavinmq/pull/1669
https://github.com/cloudamqp/lavinmq/security/advisories/GHSA-r2mh-8vq6-qf7m

Check your stack JSON