CVE-2026-109433 Details
Description
Camunda 7.24.0 before 7.24.16 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows authenticated attackers to bypass permission checks due to an inverted comparison logic in AbstractCockpitPluginResource.isPermissionDisabled(). Attackers with minimal Cockpit access can exploit a non-empty disabledPermissions configuration to read all process instances, process definitions, and incidents engine-wide without triggering any logging, regardless of their actual data grants.
An authorization bypass vulnerability has been identified in the Camunda Cockpit web application, specifically in versions 7.24.0 prior to 7.24.14 and 7.23.0 prior to 7.23.17. This vulnerability allows authenticated attackers to bypass permission checks due to an inverted comparison logic in the 'AbstractCockpitPluginResource.isPermissionDisabled()' method. Attackers with minimal Cockpit access can exploit a non-empty 'disabledPermissions' configuration to read all process instances, process definitions, and incident data across the entire engine, without triggering any logging, regardless of their actual data permissions.
Camunda 7 Community Edition has reached End of Life, so a local patch is the most realistic remedy. For Camunda 7 Enterprise Edition, version 7.24.16-ee is available, which includes the necessary fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://codeant.ai/security-research/camunda-cockpit-disabled-permissions-cve-2026-109433 | [email protected] | Technical Analysis |
| https://docs.camunda.org/enterprise/download/ | [email protected] | ProductVendor |
| https://www.vulncheck.com/advisories/camunda-broken-access-control-via-cockpit | [email protected] | AdvisoryPartial Content |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Camunda | >= 7.24.0, < 7.24.14 (semver) >= 7.23.0, < 7.23.17 (semver) |
CPE
Remediation
| |
| Camunda Cockpit | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 23, 2026 | CVE Modified | [email protected] |
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |