CVE-2026-112182: Multiple Vulnerabilities in OpenKM Community Edition
Unauthorization vulnerability in the management of workflow definitions in OpenKM Community Edition. The REST endpoints registerProcessDefinition and runProcessDefinition require authentication but do not verify roles in the WorkflowService or in lower layers. An attacker with the ROLEUSER role can register and execute a process definition containing BeanShell scripts, allowing them to execute Java code and operating system commands with the service’s privileges. In the official Docker image, the process runs as root.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.0.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.3.14 - Compensating control
On the reverse proxy or firewall, block non-administrator users from accessing /OpenKM/services/rest/workflow/* and /OpenKM/services/OKMWorkflow; if web services are not in use, block /OpenKM/services/*.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated OpenKM Community Edition user with the ROLE_USER role can exploit it. No additional role checks are performed by the affected workflow REST endpoints or lower layers.
What access does an attacker need to execute commands?
The attacker needs credentials for an account assigned ROLE_USER and access to the REST endpoints for registering and running workflow process definitions. They can include BeanShell scripts in a process definition to execute Java code and operating-system commands.
What privilege level do the resulting commands have?
Commands run with the privileges of the OpenKM service. In the official Docker image, the process runs as root, so successful exploitation can result in root-level command execution in the container.