Authorization Bypass in Camunda Cockpit Webapp

Executive Summary

CVE-2026-109433 is an authorization bypass in Camunda Cockpit (versions 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17) due to inverted comparison logic in AbstractCockpitPluginResource.isPermissionDisabled(). This flaw allows authenticated attackers with minimal access to bypass permission checks by exploiting a non-empty disabledPermissions configuration. The vulnerability grants unauthorized access to process instances, definitions, and incidents without triggering logging.

Useful 0 Not Useful 0

Detection Guidance

Check Camunda Cockpit logs for unusual access patterns or requests to process metadata endpoints. Verify if disabledPermissions is configured in your Camunda setup. Inspect network traffic for unauthorized access to /api/engine/engine/{name}/process-instance, /process-definition, or /incident endpoints.

Useful 0 Not Useful 0

Impact Analysis

Attackers with basic Cockpit access can read sensitive process metadata like instance IDs, names, start times, and incident counts across the entire engine. This exposes organizational process maps but does not allow reading variable contents. The attack bypasses logging, making it harder to detect. Default configurations without disabledPermissions are unaffected.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Camunda to versions 7.24.14 or later, or 7.23.17 or later. If upgrading is not possible, remove or correct the inverted comparison logic in AbstractCockpitPluginResource.isPermissionDisabled(). Ensure disabledPermissions is empty in your configuration to prevent exploitation.

Useful 0 Not Useful 0