OPENKM COMMUNITY EDITION · CVE-2026-112182 · Package
NO FIX YET · SEE WHAT TO DO
OpenKM Community Edition lets any user with the basic user role register and run a workflow definition that contains BeanShell scripts. The scripts execute Java code and operating system commands with the service's privileges, and the official Docker image runs that service as root.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted OpenKM Community Edition 6.3.12 and 6.3.13 installs (the 6.3 branch with the jBPM workflow engine) where any user has an ordinary account. Such a user can register a workflow containing BeanShell and run Java code and OS commands as the service account, which is root in the official Docker image. OpenKM 7.x does not include jBPM and is not affected. Anyone who cannot reach the workflow endpoints is not exposed.
Not affected if auth-required, openkm-7.x
Who cares docker, java, jbpm, openkm, openkm-6.3, self-hosted
No fixed release yet: OpenKM CE 6.3.14 is announced as pending release and will require the administrator role to create or delete process definitions. 7.x does not include jBPM and is not affected ( is the vendor's recommended migration target, per INCIBE).
Unauthorization vulnerability in the management of workflow definitions in OpenKM Community Edition. The REST endpoints registerProcessDefinition and runProcessDefinition require authentication but do not verify roles in the WorkflowService or in lower layers. An attacker with the ROLE_USER role can register and execute a process definition containing BeanShell scripts, allowing them to execute Java code and operating system commands with the service’s privileges. In the official Docker image, the process runs as root.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
7.0.4NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.