CVE-2018-12546: eclipse mosquitto Improper Access Control
Vulnerability summary
CVE-2018-12546 is a medium (CVSS 6.5) Improper Access Control vulnerability in eclipse mosquitto. EPSS estimates a 0.80% chance of exploitation in the next 30 days, higher than 55.8% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 27-03-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
In Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) when a client publishes a retained message to a topic, then has its access to that topic revoked, the retained message will still be published to clients that subscribe to that topic in the future. In some applications this may result in clients being able cause effects that would otherwise not be allowed.
CVSS metrics
6 scores · 4 sources · 3 versions- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
0.80%
Chance of exploitation in the next 30 days
Percentile
56%
Versus all other CVEs
30-day change
0.00 pp
From 0.80% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (bugs.eclipse.org)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Affected systems
Alpine1 product
- mosquitto≥ 1.0, < 1.5.6-r0 | ≥ 1.0, < 1.4.15-r1 | ≥ 1.0, < 1.4.15-r5
Debian1 product
- mosquitto< 1.5.6-1
Eclipse1 product
- mosquitto≥ 1.0, ≤ 1.5.5
The eclipse foundation1 product
- eclipse mosquitto≥ 1.0, < unspecified | ≥ unspecified, ≤ 1.5.5
Ubuntu1 product
- mosquitto< 1.4.8-1ubuntu0.16.04.5 | < 1.4.15-2ubuntu0.18.04.1
5 vendors · 5 products
