Read the docs
TI-2026-68026 Aliases CVE-2026-77226GHSA-mx4r-g275-wg5r

Incorrect authorization in Camunda 7 setup lets attackers add admins

Priority HIGH 75CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Camunda 7 from 7.24.0 before 7.24.15 contains an incorrect authorization flaw in the Admin web application's first-run setup endpoint, SetupResource (CWE-863). The setup check counts only direct members of the camunda-admin group, so it ignores other configured administrators. An unauthenticated remote attacker can create a new administrator account when that group is empty, leading to account takeover and possible process deployment or script execution as the engine's service user. An exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-admin group rather than recognizing all configured administrators. An unauthenticated remote attacker can exploit this logic flaw to call the setup user-create endpoint and create a new administrator account when the camunda-admin group is empty but the system is fully administered, resulting in account takeover and potential process deployment or script execution as the engine's service user.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00693 53rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Camunda 7 (Camunda): 7.24.15

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CamundaCamunda 77.24.0 to before 7.24.157.24.15Patch availableCNA
  • Camunda 7 VendorCamunda Affected 7.24.0 to before 7.24.15 Fixed in 7.24.15 Patch available CNA

Remediation

Upgrade Camunda 7 to version 7.24.15 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Camunda 7 (Camunda) Fixed in 7.24.15

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-77226
  2. 2026-10-06 Alias added: GHSA-mx4r-g275-wg5r
  3. 2026-10-07 CISA SSVC decision points changed
  4. 2026-10-07 Priority changed: MEDIUM → HIGH

References

Exploit 1

Patch 1

  • TI-2026-76421 Expression injection in Camunda 7 orQueries enables command execution CVSS 4.0CRITICAL 9.3
  • TI-2026-76420 Missing authorization in Camunda task comments and attachments CVSS 4.0HIGH 8.6
  • TI-2026-76422 Broken access control in Camunda Cockpit exposes process data CVSS 4.0MEDIUM 6.0
  • TI-2021-09385 Camunda Modeler (aka camunda-modeler) through 4.6.0 allows arbitrary file access. CVSS 3.1CRITICAL 9.1
  • TI-2021-06144 Prototype pollution in min-dash CVSS 3.1HIGH 7.5
  • TI-2024-34492 WordPress bpmn.io plugin <= 1.0 - Stored Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences