io.moquette:moquette-broker has a Missing Authorization issue
Moquette MQTT Broker fails to enforce ACL write permission checks when publishing Will (Last Will and Testament) messages on behalf of disconnected clients. All normal PUBLISH paths (receivedPublishQos0, receivedPublishQos1, receivedPublishQos2) correctly invoke authorizator.canWrite() before publishing, but the Will message publishing path (fireWill() → publishWill() → publish2Subscribers()) completely bypasses this authorization check. This allows an unauthenticated attacker (when allow_anonymous=true, which is the default) to inject arbitrary messages into any ACL-protected topic …