Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-109431— Camunda Missing Authorization in Task Sub-Resources

Quick assessment

Affected
Camunda Camunda 7
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Camunda 7.24.0（早于 7.24.14）和 7.23.0（早于 7.23.17）版本中，engine-rest 的任务子资源存在缺失授权检查的漏洞。该漏洞允许已认证但未获得相应权限的攻击者，通过调用缺乏授权过滤检查的单个读取和删除端点（这些检查在对应的列表端点中已强制实施），访问任务评论和附件。攻击者可利用 TaskAttachmentResourceImpl 和 TaskCommentResourceImpl 中的方法（如 getAttachment、getAttachmentData、deleteA

CVSS 8.1 · High

Affected Version Matrix 2

VendorProduct Version RangeStatus
Camunda Camunda 7 7.24.0< 7.24.14 affected
7.23.0< 7.23.17 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-109431

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Camunda Missing Authorization in Task Sub-Resources
Source: CVE Program / CVE List V5
Vulnerability Description
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling singular read and delete endpoints that lack the authorization-filtered checks enforced on their corresponding list endpoints. Attackers can exploit TaskAttachmentResourceImpl and TaskCommentResourceImpl methods such as getAttachment, getAttachmentData, deleteAttachment, and getComment using only a known object ID to read, download, or permanently delete task attachments and comments.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Camunda Camunda 7 7.24.0 ~ 7.24.14 -

II. Public POCs for CVE-2026-109431

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-109431

请登录查看更多情报信息。

Vendor Pages for CVE-2026-109431 (1)

Other References for CVE-2026-109431 (2)

Same Patch Batch · Camunda · 2026-10-19 · 3 CVEs total

CVE-2026-109432 9.8 CRITICAL Camunda Expression Injection via orQueries RCE
CVE-2026-109433 6.5 MEDIUM Camunda Broken Access Control via Cockpit

IV. Related Vulnerabilities

Same product: Camunda 7
Same vendor: Camunda
Same weakness: CWE-862

V. Comments for CVE-2026-109431

No comments yet

Leave a comment