Live › vulnerability › CVE-2026-109433
Go to dashboardCamunda's Cockpit web app has an inverted comparison in its permission check, so an authenticated user with minimal Cockpit access can read every process instance, process definition and incident in the engine. The read happens without any log entry, whatever the user's actual data grants are.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running self-hosted Camunda 7 with the Cockpit web app, on 7.23.0 to 7.23.16 or 7.24.0 to 7.24.15. The flaw only matters if a non-empty disabledPermissions setting is configured, and the attacker needs a Cockpit account with minimal access. Installs on other Camunda major versions or without Cockpit are not covered by these sources.
No product ranges from the sources yet.
unknown; the sources do not give a command for this.disabledPermissions setting in the Cockpit plugin configuration.7.24.16 or later.7.23.17 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Camunda 7.24.0 before 7.24.16 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows authenticated attackers to bypass permission checks due to an inverted comparison logic in AbstractCockpitPluginResource.isPermissionDisabled(). Attackers with minimal Cockpit access can exploit a non-empty disabledPermissions configuration to read all process instances, process definitions, and incidents engine-wide without triggering any logging, regardless of their actual data grants.
This page as .md · .json · in your agent: get_signal("CVE-2026-109433")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.