{"id":"CVE-2018-12546","url":"https://www.cyber-defence.io/tools/cve/CVE-2018-12546","generatedAt":"2026-10-28T22:43:36.604Z","title":"In some applications this may result in clients being able cause effects that would otherwise not be allowed.","description":"In Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) when a client publishes a retained message to a topic, then has its access to that topic revoked, the retained message will still be published to clients that subscribe to that topic in the future. In some applications this may result in clients being able cause effects that would otherwise not be allowed.","published":"2019-03-27T18:29:00.000Z","lastModified":"2026-06-17T01:37:57.000Z","status":"Modified","sourceIdentifier":"emo@eclipse.org","cvss":{"version":"3.1","score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},"cwe":["CWE-284","CWE-732"],"affected":["eclipse/mosquitto"],"epss":{"score":0.00802,"percentile":0.56473,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.80%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://bugs.eclipse.org/bugs/show_bug.cgi?id=543127","tags":["Exploit","Issue Tracking","Vendor Advisory"],"source":"emo@eclipse.org"},{"url":"https://bugs.eclipse.org/bugs/show_bug.cgi?id=543127","tags":["Exploit","Issue Tracking","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-12546","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}