CVE-2018-12546 Missing authorization in Eclipse Mosquitto

What is CVE-2018-12546?

CVE-2018-12546 is a medium-severity missing authorization vulnerability in The Eclipse Foundation Eclipse Mosquitto, published on 27 Mar 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) when a client publishes a retained message to a topic, then has its access to that topic revoked, the retained message will still be published to clients that subscribe to that topic in the future. In some applications this may result in clients being able cause effects that would otherwise not be allowed.

Weakness: CWE-732, CWE-284

Which versions are affected by CVE-2018-12546?

It affects 1 product.

Products include Eclipse Mosquitto.

How do I fix CVE-2018-12546?

Upgrade to a fixed version.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2018-12546 being exploited?

There is no known exploitation of CVE-2018-12546 in the wild and no public exploit code.

Other vulnerabilities in The Eclipse Foundation Eclipse Mosquitto

• CVE-2018-12550 Auth bypass in Eclipse Mosquitto High 8.1
• CVE-2018-12551 Auth bypass in Eclipse Mosquitto High 8.1
• CVE-2023-5632 Unconditionally adding an event to the epoll causes excessive CPU consumption High 7.5
• CVE-2023-28366 Denial of service in n/a High 7.5
• CVE-2021-41039 Denial of service in Eclipse Mosquitto High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2018-12546, DEBIAN-CVE-2018-12546, GHSA-mx88-h56f-w25v, UBUNTU-CVE-2018-12546.