{"id":"CVE-2026-109431","kind":"vulnerability","aliases":["CVE-2026-109431"],"related":[],"title":"Camunda: missing authorization lets users read or delete task attachments","description":"Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling singular read and delete endpoints that lack the authorization-filtered checks enforced on their corresponding list endpoints. Attackers can exploit TaskAttachmentResourceImpl and TaskCommentResourceImpl methods such as getAttachment, getAttachmentData, deleteAttachment, and getComment using only a known object ID to read, download, or permanently delete task attachments and comments.","summary":"Camunda's engine REST API lets any authenticated user with no task permissions read, download or delete task comments and attachments if they know the object ID. An attacker can permanently delete or exfiltrate workflow task data.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["camunda","camunda-7","engine-rest","other","self-hosted"],"not_affected_if":["camunda-8","no-rest-api-exposed"],"how_to_check":null,"fix":"Upgrade Camunda 7.24.x to 7.24.14 or later, or 7.23.x to 7.23.17 or later.","status":"open","published_at":"2026-10-19T16:17:02+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-23T22:39:47+00:00","updated_at":"2026-10-23T22:39:47+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T22:39:47Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Camunda 7.24.x to 7.24.14 or later, or 7.23.x to 7.23.17 or later.","reach":"network","title":"Camunda: missing authorization lets users read or delete task attachments","impact":"medium","summary":"Camunda's engine REST API lets any authenticated user with no task permissions read, download or delete task comments and attachments if they know the object ID. An attacker can permanently delete or exfiltrate workflow task data.","category":"other","who_cares":["camunda","camunda-7","engine-rest","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"attacker reads or permanently deletes task attachments and comments","analyst_note":"","how_to_check":"unknown","needs_analyst":false,"not_affected_if":["camunda-8","no-rest-api-exposed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000471,"input_tokens":3042,"output_tokens":334,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-109431':13A,16A '-2026':12A,15A '-7':19B '7.23.0':69C '7.23.17':71C '7.24.0':65C '7.24.14':67C 'access':95C 'allow':87C 'api':31B 'attach':10A,47B,99C,147C 'attack':55B,89C,120C 'authent':34B,88C 'author':3A,75C,111C 'authorization-filt':110C 'call':101C 'camunda':1A,17B,18B,27B,64C 'check':76C,113C 'comment':45B,97C,149C 'contain':72C 'correspond':117C 'cve':11A,14A 'data':63B 'delet':8A,43B,58B,105C,145C 'deleteattach':131C 'download':41B,142C 'endpoint':106C,119C 'enforc':114C 'engin':21B,29B,80C 'engine-rest':20B,79C 'exfiltr':60B 'exploit':122C 'filter':112C 'getattach':129C 'getattachmentdata':130C 'getcom':133C 'grant':93C 'host':26B 'id':53B,139C 'know':50B 'known':137C 'lack':108C 'let':4A,32B 'list':118C 'method':126C 'miss':2A,74C 'object':52B,138C 'perman':57B,144C 'permiss':39B,92C 'read':6A,40B,103C,141C 'resourc':85C 'rest':22B,30B,81C 'self':25B 'self-host':24B 'singular':102C 'sub':84C 'sub-resourc':83C 'task':9A,38B,44B,62B,82C,96C,146C 'taskattachmentresourceimpl':123C 'taskcommentresourceimpl':125C 'use':134C 'user':5A,35B 'vulner':77C 'workflow':61B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T16:17:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109431","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109431","severity":null,"published_at":"2026-10-19T16:17:02+00:00","modified_at":"2026-10-19T21:13:39+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}