Skip to content
OpenAdvisories
High WID-SEC-2026-4033 3 CVEs

Camunda: Mehrere Schwachstellen

Published Oct 19, 2026 · Updated Oct 19, 2026 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Camunda ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, Dateien zu manipulieren, und beliebigen Programmcode auszuführen.

Product

Camunda ist ein in Java geschriebenes freies Workflow-Management-System, mit dem Geschäftsprozesse in BPMN 2.0 definiert und ausgeführt werden können.

Vulnerabilities 3

  • Critical 9.8
    CVE-2026-109432

    Camunda Expression Injection via orQueries RCE

    Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated use…

    Camunda Camunda 7
  • High 8.1
    CVE-2026-109431

    Camunda Missing Authorization in Task Sub-Resources

    Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling sin…

    Camunda Camunda 7
  • Medium 6.5
    CVE-2026-109433

    Camunda Broken Access Control via Cockpit

    Camunda 7.24.0 before 7.24.16 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows authenticated attackers to bypass permission checks due to an inverted comparison logic in AbstractCockpitPluginResource.i…

    Camunda Camunda 7

Revision history

  1. #1

    Initiale Fassung

References