Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Camunda 7 7.23.17, 7.24.14 Clear all filters
TI-2026-76421 CVE-2026-109432 · GHSA-mqfw-m4cx-w4jp

Expression injection in Camunda 7 orQueries enables command execution

Priority HIGH 81

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression maps within the orQueries field exposed by T…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00558 Published 2026-10-19 Fixed in 7.24.14, 7.23.17 CWE-78
TI-2026-76420 CVE-2026-109431 · GHSA-9vfr-59xg-h3vg

Missing authorization in Camunda task comments and attachments

Priority HIGH 72

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task…

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00359 Published 2026-10-19 Fixed in 7.24.14, 7.23.17 CWE-639