Read the docs
TI-2026-76422 Aliases CVE-2026-109433GHSA-cm9q-c667-7h4q

Broken access control in Camunda Cockpit exposes process data

Priority MEDIUM 60CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Camunda 7 from 7.24.0 before 7.24.16 and from 7.23.0 before 7.23.17 has an incorrect authorization flaw in the Cockpit webapp (CWE-863). An inverted comparison in the permission check lets an authenticated user with minimal Cockpit access read all process instances, process definitions and incidents across the engine, without logging, when disabledPermissions is set to a non-empty value. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Camunda 7.24.0 before 7.24.16 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows authenticated attackers to bypass permission checks due to an inverted comparison logic in AbstractCockpitPluginResource.isPermissionDisabled(). Attackers with minimal Cockpit access can exploit a non-empty disabledPermissions configuration to read all process instances, process definitions, and incidents engine-wide without triggering any logging, regardless of their actual data grants.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00434 37th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Camunda 7 (Camunda): 7.24.16, 7.23.17

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CamundaCamunda 77.24.0 to before 7.24.16; 7.23.0 to before 7.23.177.24.16, 7.23.17Patch availableCNA
  • Camunda 7 VendorCamunda Affected 7.24.0 to before 7.24.16; 7.23.0 to before 7.23.17 Fixed in 7.24.16, 7.23.17 Patch available CNA

Remediation

Upgrade Camunda 7 to version 7.24.16 or 7.23.17, the fixed versions for each line.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Camunda 7 (Camunda) Fixed in 7.24.16, 7.23.17

Timeline

  1. 2026-10-19 Threatist record created from CVE-2026-109433
  2. 2026-10-20 Alias added: GHSA-cm9q-c667-7h4q
  3. 2026-10-23 Fix available: Camunda/Camunda [email protected] · CNA

References

Exploit 1

Patch 1

  • TI-2026-76421 Expression injection in Camunda 7 orQueries enables command execution CVSS 4.0CRITICAL 9.3
  • TI-2026-68026 Incorrect authorization in Camunda 7 setup lets attackers add admins CVSS 4.0CRITICAL 9.2
  • TI-2026-76420 Missing authorization in Camunda task comments and attachments CVSS 4.0HIGH 8.6
  • TI-2021-09385 Camunda Modeler (aka camunda-modeler) through 4.6.0 allows arbitrary file access. CVSS 3.1CRITICAL 9.1
  • TI-2021-06144 Prototype pollution in min-dash CVSS 3.1HIGH 7.5
  • TI-2024-34492 WordPress bpmn.io plugin <= 1.0 - Stored Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences