An unauthenticated authorization bypass in the Moquette MQTT broker allows attackers to inject unauthorized messages into restricted topics, posing a significant risk to data integrity.

This vulnerability occurs due to a missing authorization check in the PostOffice.publishWill function, which fails to validate write permissions or reserved-topic constraints for Last-Will messages. Any unauthenticated client can leverage this flaw to publish messages to topics they are not authorized to access.

The ability to inject unauthorized messages into restricted MQTT topics can lead to severe operational disruptions, unauthorized command execution in IoT environments, or the corruption of data streams. Given the CVSS score of 8.7, this is a high-severity flaw that requires immediate attention to prevent the manipulation of sensitive message queues or control systems.

Immediate Action: Update the moquette-io moquette broker to version 0.18.1 or later to implement the necessary authorization checks for Last-Will messages.

Proactive Monitoring: Review broker access logs for unexpected Last-Will configurations or spikes in traffic directed toward restricted or sensitive topics.

Compensating Controls: Implement strict network-level access controls to limit which clients can connect to the MQTT broker, and utilize topic-level ACLs to restrict message publishing capabilities to trusted entities.

Public Exploit Available: No (exploit_available: unknown)

The severity of this vulnerability, combined with the lack of required authentication to trigger the flaw, necessitates immediate remediation. Administrators should prioritize patching to version 0.18.1 to ensure that authorization policies are correctly applied to all message types. Failure to update leaves the messaging infrastructure vulnerable to unauthorized message injection and potential system compromise.