CVE-2026-109431
Received Received - Intake

Camunda Missing Authorization in Task Attachments and Comments

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulnCheck

Description
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling singular read and delete endpoints that lack the authorization-filtered checks enforced on their corresponding list endpoints. Attackers can exploit TaskAttachmentResourceImpl and TaskCommentResourceImpl methods such as getAttachment, getAttachmentData, deleteAttachment, and getComment using only a known object ID to read, download, or permanently delete task attachments and comments.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-109431
EUVD
EUVD-2026-104391

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Camunda Camunda 7 7.24.0
Camunda Camunda 7 7.23.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Camunda versions 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 is a missing authorization check in engine-rest task sub-resources. Authenticated attackers with no permissions can access task comments and attachments by exploiting endpoints like getAttachment, getAttachmentData, deleteAttachment, and getComment using only a known object ID. These endpoints lack proper authorization filters present in their corresponding list endpoints.

Detection Guidance

Check Camunda server logs for unauthorized access attempts to task attachments or comments endpoints. Monitor for GET or DELETE requests to /engine-rest/task/{id}/attachment/{attachmentId} or /engine-rest/task/{id}/comment/{commentId} without proper authorization.

Impact Analysis

An attacker could read sensitive task comments or download attachments containing confidential data. They could also permanently delete task attachments or comments, disrupting workflows or causing data loss. The impact includes unauthorized data exposure, potential compliance violations, and operational disruptions in systems using affected Camunda versions.

Compliance Impact

This vulnerability could lead to unauthorized access or deletion of sensitive data, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations using affected Camunda versions may face compliance failures, regulatory penalties, or reputational damage due to potential data breaches or loss of protected health information.

Mitigation Strategies

Upgrade Camunda to version 7.24.14 or later for 7.24.x, or 7.23.17 or later for 7.23.x. If immediate upgrade is not possible, restrict network access to the engine-rest API and review all user permissions to ensure least privilege.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109431. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart