Take the account session lock when deleting from map

server/mqtt.go

@@ -3319,8 +3319,10 @@ func (s *Server) mqttCheckPubRetainedPerms() {
 			// Not present or permissions have changed such that the source can't
 			// publish on that subject anymore: remove it from the map.
 			if u == nil {
+				asm.mu.Lock()
 				delete(asm.retmsgs, rf.subj)
 				asm.sl.Remove(rf.rmsg.sub)
+				asm.mu.Unlock()
 				deletes[rf.subj] = rf.rmsg.sseq
 			}
 		}