---
id: "CVE-2026-109433"
kind: "vulnerability"
aliases: ["CVE-2026-109433"]
title: "Camunda Cockpit: inverted permission check exposes all process data to users"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["camunda", "camunda-7", "cockpit", "java", "package", "self-hosted"]
not_affected_if: ["auth-required", "camunda-8", "default-config", "no-cockpit"]
published_at: "2026-10-19T16:17:02+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T03:55:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109433", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# Camunda Cockpit: inverted permission check exposes all process data to users

Camunda's Cockpit web app has an inverted comparison in its permission check, so an authenticated user with minimal Cockpit access can read every process instance, process definition and incident in the engine. The read happens without any log entry, whatever the user's actual data grants are.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Camunda version with `unknown`; the sources do not give a command for this.
- Look for a non-empty `disabledPermissions` setting in the Cockpit plugin configuration.

## Fix

- Upgrade Camunda 7.24.x installs to `7.24.16` or later.
- Upgrade Camunda 7.23.x installs to `7.23.17` or later.

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109433

## From the sources

Camunda 7.24.0 before 7.24.16 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows authenticated attackers to bypass permission checks due to an inverted comparison logic in AbstractCockpitPluginResource.isPermissionDisabled(). Attackers with minimal Cockpit access can exploit a non-empty disabledPermissions configuration to read all process instances, process definitions, and incidents engine-wide without triggering any logging, regardless of their actual data grants.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_