# io.moquette:moquette-broker has a Missing Authorization issue

Moquette MQTT broker skips ACL canWrite() checks when publishing Will messages, letting anonymous clients inject into restricted topics and chain to CC6 deserialization RCE.

- Payout: Research
- Severity: high
- Program: Moquette
- Found by: Fireees, Robin-szu
- Disclosed: 2026-09-18
- CVE: CVE-2026-85058
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-9jjc-fw8x-fmwx
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-9jjc-fw8x-fmwx
- Tags: area:devices domain:iot domain:network impact:integrity impact:rce kind:research platform:ghsa sev:high tech:java technique:chained vuln:access-control vuln:auth-bypass vuln:deserialization

**Target:** MQTT broker (PostOffice.java Will publish path)
**Root cause:** fireWill()/publishWill() call publish2Subscribers() directly without invoking authorizator.canWrite(), unlike all normal PUBLISH paths; SessionRegistry.createNewWill() also stores the Will topic without a pre-check.
**Steps:**
1. Configure acl.conf with `topic write allowed/topic` and `topic read restricted/topic` (topic rules, not pattern rules, since pattern rules are skipped for null usernames), enable `acl_file` and `allow_anonymous true`.
2. Subscriber connects and subscribes to `restricted/topic`.
3. Verify direct PUBLISH to `restricted/topic` is rejected by ACL.
4. Attacker sends CONNECT with Will Topic=`restricted/topic` and arbitrary Will payload, then aborts the TCP connection with RST (no DISCONNECT).
5. Broker fires the Will via fireWill()→publishWill()→publish2Subscribers() with no canWrite() check; subscriber receives the message on the restricted topic.
**How found:** Compared the Will publishing path against normal PUBLISH handlers and noticed receivedPublishQos0/1/2 all call authorizator.canWrite() while fireWill()/publishWill() do not; cross-checked Mosquitto, EMQX and HiveMQ behavior to confirm Will messages are normally ACL-checked.
**Exploitation:** Anonymous attacker connects with Will Topic set to an ACL-restricted topic and Will payload containing a Commons Collections CC6 serialized gadget; abrupt TCP RST triggers Will publication, delivering the payload to subscribers that call ObjectInputStream.readObject(), executing `touch /tmp/pwned_by_will_bypass_<ts>` on the victim.
**Escalation:** Chained the ACL bypass with a victim-side Java deserialization sink (CC6 gadget) to convert topic injection into remote code execution.
**Insight:** When auditing brokers/message buses, enumerate every internal publish path (Will, retained, bridge, system topics) and diff them against the main PUBLISH handler for missing authorization calls; also note Moquette's AuthorizationsCollector skips `pattern` ACL rules for anonymous users, so test with `topic` rules.