---
id: "CVE-2026-109431"
kind: "vulnerability"
aliases: ["CVE-2026-109431"]
title: "Camunda: missing authorization lets users read or delete task attachments"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["camunda", "camunda-7", "engine-rest", "other", "self-hosted"]
not_affected_if: ["camunda-8", "no-rest-api-exposed"]
published_at: "2026-10-19T16:17:02+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-23T22:39:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109431", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# Camunda: missing authorization lets users read or delete task attachments

Camunda's engine REST API lets any authenticated user with no task permissions read, download or delete task comments and attachments if they know the object ID. An attacker can permanently delete or exfiltrate workflow task data.

_Summary, check and fix written by a model from the sources; labelled as such._

## Fix

Upgrade Camunda 7.24.x to 7.24.14 or later, or 7.23.x to 7.23.17 or later.

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109431

## From the sources

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling singular read and delete endpoints that lack the authorization-filtered checks enforced on their corresponding list endpoints. Attackers can exploit TaskAttachmentResourceImpl and TaskCommentResourceImpl methods such as getAttachment, getAttachmentData, deleteAttachment, and getComment using only a known object ID to read, download, or permanently delete task attachments and comments.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_