CVE-2026-109431

Awaiting Analysis Awaiting Analysis - Queue

Camunda Missing Authorization in Task Attachments and Comments

Publication date: 2026-10-19

Last updated on: 2026-10-27

Assigner: VulnCheck

Description

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling singular read and delete endpoints that lack the authorization-filtered checks enforced on their corresponding list endpoints. Using only a known object ID, attackers can exploit TaskAttachmentResourceImpl and TaskCommentResourceImpl methods such as getAttachment, getAttachmentData, deleteAttachment, and getComment to read or download task attachments and comments and to permanently delete task attachments.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-27

Generated

2026-11-08

AI Q&A

2026-10-19

EPSS Evaluated

2026-11-07

NVD

CVE-2026-109431

EUVD

EUVD-2026-104391

Affected Vendors & Products

Vendor	Product	Version / Range
Camunda	Camunda 7	7.24.0
Camunda	Camunda 7	7.23.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability in Camunda versions 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 is a missing authorization check in engine-rest task sub-resources. Authenticated attackers with no permissions can access task comments and attachments by exploiting endpoints like getAttachment, getAttachmentData, deleteAttachment, and getComment using only a known object ID. These endpoints lack proper authorization filters present in their corresponding list endpoints.

Detection Guidance

Check Camunda server logs for unauthorized access attempts to task attachments or comments endpoints. Monitor for GET or DELETE requests to /engine-rest/task/{id}/attachment/{attachmentId} or /engine-rest/task/{id}/comment/{commentId} without proper authorization.

Impact Analysis

An attacker could read sensitive task comments or download attachments containing confidential data. They could also permanently delete task attachments or comments, disrupting workflows or causing data loss. The impact includes unauthorized data exposure, potential compliance violations, and operational disruptions in systems using affected Camunda versions.

Compliance Impact

This vulnerability could lead to unauthorized access or deletion of sensitive data, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations using affected Camunda versions may face compliance failures, regulatory penalties, or reputational damage due to potential data breaches or loss of protected health information.

Mitigation Strategies

Upgrade Camunda to version 7.24.14 or later for 7.24.x, or 7.23.17 or later for 7.23.x. If immediate upgrade is not possible, restrict network access to the engine-rest API and review all user permissions to ensure least privilege.

Hi! I’m here to help you understand CVE-2026-109431. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...