Description

Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-13T14:16:56.120Z",
  "pubdate": "2026-08-13T14:16:56.120Z",
  "executiveSummary": "An access control vulnerability affecting subscriber components has been identified in Solace Extra versions up to and including 1.6.0. This security flaw stems from insufficient authorization enforcement within the subscriber functionality, allowing unauthorized users to interact with sensitive subscriber operations or data channels that should otherwise be restricted.\nThe primary impact of this vulnerability involves the potential bypass of intended access boundaries, which can lead to unauthorized data exposure, manipulation of subscriber states, or unauthorized execution of privileged messaging actions within the affected system. Depending on the broader application architecture, successful exploitation may compromise the confidentiality and integrity of messages processed by the messaging broker integration.\nThe vulnerability affects all deployments utilizing Solace Extra versions <= 1.6.0. Risk implications include unauthorized tampering with subscription parameters and potential exposure of sensitive payload data to actors lacking the requisite authorization levels. Exploitation generally requires network connectivity to the target application interface hosting the vulnerable subscriber module, along with the ability to craft or manipulate subscription-related requests.\nNo specific preconditions or complex authentication bypasses are explicitly detailed beyond the core access control failure, indicating that the vulnerability resides within the inherent validation logic of the subscriber component itself. Organizations utilizing the affected software versions face operational and security risks until proper access checks are enforced.",
  "technicalDetails": "The root cause of this vulnerability lies in the broken access control implementation within the subscriber module of Solace Extra versions <= 1.6.0. Specifically, the application fails to adequately verify whether an authenticated or unauthenticated entity possesses the necessary privileges or authorization tokens to perform specific subscriber-related actions or access restricted subscription endpoints.\nFrom a component perspective, the vulnerability is localized to the subscriber routing and authorization enforcement functions responsible for managing client subscriptions and message routing permissions. When a client initiates a subscriber interaction, the underlying logic processes the request without enforcing stringent role-based or attribute-based access controls, granting access to restricted resources or channels by default.\nThe attack flow typically proceeds as follows: An attacker with network access to the vulnerable Solace Extra instance crafts a malicious or unauthorized subscriber request targeting restricted topics, queues, or administrative subscriber functions. Because the vulnerable component lacks proper validation checks against the requester's identity or privilege level, the application processes the request as legitimate.\nAs a result, the attacker successfully binds to or interacts with subscriber channels that should be restricted, potentially allowing them to intercept, consume, or inject messages into unauthorized execution flows. The exact payload behavior depends on the specific subscriber endpoint targeted, but generally results in unauthorized read or write access to data streams managed by the application.\nNetwork exposure is dictated by the accessibility of the interface hosting the Solace Extra subscriber functionality. Authentication and privilege requirements are bypassed or insufficiently validated due to the flawed access control logic, allowing actors to perform actions exceeding their intended trust boundary. The post-exploitation impact encompasses potential data leakage, unauthorized monitoring of messaging channels, and potential disruption of dependent messaging workflows."
}