CVE-2026-109431: Camunda Missing Authorization in Task Sub-Resources
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling singular read and delete endpoints that lack the authorization-filtered checks enforced on their corresponding list endpoints. Attackers can exploit TaskAttachmentResourceImpl and TaskCommentResourceImpl methods such as getAttachment, getAttachmentData, deleteAttachment, and getComment using only a known object ID to read, download, or permanently delete task attachments and comments.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Affected versions are Camunda 7.24.0 through versions before 7.24.14, and Camunda 7.23.0 through versions before 7.23.17. The issue is in engine-rest task sub-resource endpoints.
What does an attacker need to exploit this issue?
An attacker needs to be authenticated, but does not need any permission grants. They also need a known task attachment or comment object ID to invoke the vulnerable singular read or delete endpoints.
What data or actions are exposed?
An attacker can read task comments, download task attachments, and permanently delete task attachments or comments. The affected operations include attachment retrieval, attachment-data retrieval, attachment deletion, and comment retrieval.
Are list endpoints affected in the same way?
No. The corresponding list endpoints enforce authorization-filtered checks; the missing checks are in the singular task sub-resource read and delete endpoints.