CVE-2026-109433: Camunda Broken Access Control via Cockpit
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows authenticated attackers to bypass permission checks due to an inverted comparison logic in AbstractCockpitPluginResource.isPermissionDisabled(). Attackers with minimal Cockpit access can exploit a non-empty disabledPermissions configuration to read all process instances, process definitions, and incidents engine-wide without triggering any logging, regardless of their actual data grants.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Camundato a version that resolves this vulnerability.Fixed in 7.24.14 - Upgrade
Upgrade
Camundato a version that resolves this vulnerability.Fixed in 7.23.17
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Camunda 7 Cockpit deployments running 7.24.0 through versions before 7.24.14, or 7.23.0 through versions before 7.23.17, are affected when the Cockpit disabledPermissions configuration is non-empty. The attacker must already be authenticated and have minimal Cockpit access.
What can an attacker access if exploitation succeeds?
An attacker can read process instances, process definitions, and incidents across the engine, regardless of the data permissions actually granted to that account. The issue affects confidentiality; no integrity or availability impact is stated.
Does exploitation require user interaction or a complex attack path?
No user interaction is required, and the attack complexity is low. Exploitation is performed over the network by an authenticated user with minimal Cockpit access.
How can I reduce exposure if I cannot patch immediately?
Ensure the Cockpit disabledPermissions configuration is empty, since a non-empty configuration is a stated condition for exploitation. Also restrict Cockpit access to only trusted users until an update can be applied.
Will normal logging reveal exploitation?
No. The described access to engine-wide data occurs without triggering any logging, so the provided information does not identify a reliable log-based indicator of past exploitation.