Live › vulnerability › CVE-2026-109431
Go to dashboardCamunda's engine REST API lets any authenticated user with no task permissions read, download or delete task comments and attachments if they know the object ID. An attacker can permanently delete or exfiltrate workflow task data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Unknown from the sources.
Upgrade Camunda 7.24.x to 7.24.14 or later, or 7.23.x to 7.23.17 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling singular read and delete endpoints that lack the authorization-filtered checks enforced on their corresponding list endpoints. Attackers can exploit TaskAttachmentResourceImpl and TaskCommentResourceImpl methods such as getAttachment, getAttachmentData, deleteAttachment, and getComment using only a known object ID to read, download, or permanently delete task attachments and comments.
This page as .md · .json · in your agent: get_signal("CVE-2026-109431")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.