What is the CVSS score of CVE-2026-25767?

CVE-2026-25767 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Lavinmq are affected by CVE-2026-25767?

A high-severity vulnerability in LavinMQ allows authenticated users with 'Policymaker' privileges to bypass access controls and create unauthorized shovels, potentially enabling data exfiltration or…. A patch is available.

How to fix or mitigate CVE-2026-25767?

Within 24 hours: Inventory all LavinMQ deployments and identify users with 'Policymaker' tag; immediately audit recent shovel creation activity for suspicious patterns. Within 7 days: Apply vendor patch to upgrade LavinMQ to version 2.6.8 or later across all affected systems. Within 30 days: Conduct post-patch security review, reset credentials for high-privilege accounts, and implement enhanced monitoring on shovel creation activities.

Lavinmq CVE-2026-25767

HIGH

Incorrect Authorization (CWE-863)

2026-02-12 security-advisories@github.com

Authentication Bypass Lavinmq

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

Patch released

Feb 20, 2026 - 18:35 nvd

Patch available

CVE Published

Feb 12, 2026 - 20:16 nvd

HIGH 8.1

DescriptionGitHub Advisory

LavinMQ is a high-performance message queue & streaming server. Before 2.6.8, an authenticated user, with the “Policymaker” tag, could create shovels bypassing access controls. an authenticated user with the "Policymaker" management tag could exploit it to read messages from vhosts they are not authorized to access or publish messages to vhosts they are not authorized to access. This vulnerability is fixed in 2.6.8.

AnalysisAI

Authenticated users holding the Policymaker tag in LavinMQ prior to version 2.6.8 can create shovels that bypass access controls, allowing them to read from or publish messages to unauthorized virtual hosts. This privilege escalation vulnerability affects multi-tenant deployments where access segregation is critical. A patch is available in version 2.6.8 and later.

Technical ContextAI

Classified as CWE-863 (Incorrect Authorization). Affects Lavinmq. LavinMQ is a high-performance message queue & streaming server. Before 2.6.8, an authenticated user, with the “Policymaker” tag, could create shovels bypassing access controls. an authenticated user with the "Policymaker" management tag could exploit it to read messages from vhosts they are not authorized to access or publish messages to vhosts they are not authorized to access. This vulnerability is fixed in 2.6.8.