CVE-2026-85058

## Summary Moquette MQTT Broker fails to enforce ACL write permission checks when publishing Will (Last Will and Testament) messages on behalf of disconnected clients. All normal PUBLISH paths (`receivedPublishQos0`, `receivedPublishQos1`, `receivedPublishQos2`) correctly invoke `authorizator.canWrite()` before publishing, but the Will message publishing path (`fireWill()` → `publishWill()` → `publish2Subscribers()`) completely bypasses this authorization check. This allows an unauthenticated attacker (when `allow_anonymous=true`, which is the default) to inject arbitrary messages into any ACL-protected topic by setting a restricted topic as the Will Topic in the CONNECT packet and then disconnecting abruptly via TCP RST. Other major MQTT Broker implementations (Mosquitto, EMQX, HiveMQ) correctly enforce ACL checks on Will messages, confirming this is a bug, not a design choice. ## Details In the MQTT protocol, a client can declare a "Will" topic and message in the CONNECT packet. When the client disconnects abnormally (without sending a DISCONNECT packet), the Broker publishes the Will message on behalf of the client. Although the Will message content (topic and payload) is entirely controlled by the connecting client — making it functionally equivalent to a PUBLISH — Moquette skips the ACL check for this path. ### Root Cause **File**: `broker/src/main/java/io/moquette/broker/PostOffice.java` (v0.18.0) Will publishing path (lines 286-328) — **no canWrite() check**: ```java public void fireWill(Session bindedSession) { final ISessionsRepository.Will will = bindedSession.getWill(); if (will.delayInterval == 0) { publishWill(will); // No canWrite() check! } else { trackWillSpecificationForFutureFire(...); } } private void publishWill(ISessionsRepository.Will will) { // ... build message ... publish2Subscribers(WILL_PUBLISKER, messageExpiryInstant, willPublishMessage); // No canWrite() check! } ``` Normal PUBLISH p