{"id":"CVE-2026-109433","kind":"vulnerability","aliases":["CVE-2026-109433"],"related":[],"title":"Camunda Cockpit: inverted permission check exposes all process data to users","description":"Camunda 7.24.0 before 7.24.16 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows authenticated attackers to bypass permission checks due to an inverted comparison logic in AbstractCockpitPluginResource.isPermissionDisabled(). Attackers with minimal Cockpit access can exploit a non-empty disabledPermissions configuration to read all process instances, process definitions, and incidents engine-wide without triggering any logging, regardless of their actual data grants.","summary":"Camunda's Cockpit web app has an inverted comparison in its permission check, so an authenticated user with minimal Cockpit access can read every process instance, process definition and incident in the engine. The read happens without any log entry, whatever the user's actual data grants are.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["camunda","camunda-7","cockpit","java","package","self-hosted"],"not_affected_if":["auth-required","camunda-8","default-config","no-cockpit"],"how_to_check":"- Check the Camunda version with `unknown`; the sources do not give a command for this.\n- Look for a non-empty `disabledPermissions` setting in the Cockpit plugin configuration.","fix":"- Upgrade Camunda 7.24.x installs to `7.24.16` or later.\n- Upgrade Camunda 7.23.x installs to `7.23.17` or later.","status":"open","published_at":"2026-10-19T16:17:02+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:55:55+00:00","updated_at":"2026-10-25T03:55:55+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:55:55Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Camunda 7.24.x installs to `7.24.16` or later.\n- Upgrade Camunda 7.23.x installs to `7.23.17` or later.","reach":"network","title":"Camunda Cockpit: inverted permission check exposes all process data to users","impact":"medium","summary":"Camunda's Cockpit web app has an inverted comparison in its permission check, so an authenticated user with minimal Cockpit access can read every process instance, process definition and incident in the engine. The read happens without any log entry, whatever the user's actual data grants are.","category":"package","nicknames":[],"who_cares":["camunda","camunda-7","cockpit","self-hosted","java"],"confidence":0.7,"needs_auth":"yes","worst_case":"Authenticated low-privilege user reads all process data engine-wide, silently","analyst_note":"Confirm the exact affected version ranges and the default value of disabledPermissions at the Camunda advisory; the NVD entry alone gives no fix guidance beyond version numbers.","how_to_check":"- Check the Camunda version with `unknown`; the sources do not give a command for this.\n- Look for a non-empty `disabledPermissions` setting in the Cockpit plugin configuration.","needs_analyst":true,"not_affected_if":["default-config","no-cockpit","camunda-8","auth-required"],"who_is_affected":"Teams running self-hosted Camunda 7 with the Cockpit web app, on 7.23.0 to 7.23.16 or 7.24.0 to 7.24.15. The flaw only matters if a non-empty disabledPermissions setting is configured, and the attacker needs a Cockpit account with minimal access. Installs on other Camunda major versions or without Cockpit are not covered by these sources.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000666,"input_tokens":3419,"output_tokens":648,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109433':14A,17A '-2026':13A,16A '-7':20B '7.23.0':79C '7.23.17':81C '7.24.0':75C '7.24.16':77C 'abstractcockpitpluginresource.ispermissiondisabled':106C 'access':47B,111C 'actual':71B,139C 'allow':92C 'app':31B 'attack':94C,107C 'authent':42B,93C 'author':84C 'bypass':85C,96C 'camunda':1A,18B,19B,27B,74C 'check':5A,39B,98C 'cockpit':2A,21B,29B,46B,89C,110C 'comparison':35B,103C 'configur':119C 'contain':82C 'cve':12A,15A 'data':9A,72B,140C 'definit':54B,126C 'disabledpermiss':118C 'due':99C 'empti':117C 'engin':59B,130C 'engine-wid':129C 'entri':66B 'everi':50B 'exploit':113C 'expos':6A 'grant':73B,141C 'happen':62B 'host':26B 'incid':56B,128C 'instanc':52B,124C 'invert':3A,34B,102C 'java':22B 'log':65B,135C 'logic':104C 'minim':45B,109C 'non':116C 'non-empti':115C 'packag':23B 'permiss':4A,38B,97C 'process':8A,51B,53B,123C,125C 'read':49B,61B,121C 'regardless':136C 'self':25B 'self-host':24B 'trigger':133C 'user':11A,43B,69B 'vulner':86C 'web':30B 'webapp':90C 'whatev':67B 'wide':131C 'without':63B,132C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Camunda 7 with the Cockpit web app, on 7.23.0 to 7.23.16 or 7.24.0 to 7.24.15. The flaw only matters if a non-empty disabledPermissions setting is configured, and the attacker needs a Cockpit account with minimal access. Installs on other Camunda major versions or without Cockpit are not covered by these sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T16:17:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109433","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109433","severity":null,"published_at":"2026-10-19T16:17:02+00:00","modified_at":"2026-10-23T17:17:20+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}