{"id":"CVE-2026-112182","kind":"vulnerability","aliases":["CVE-2026-112182"],"related":[],"title":"OpenKM Community 6.3.x: any logged-in user can run OS commands through workflow definitions","description":"Unauthorization vulnerability in the management of workflow definitions in OpenKM Community Edition. The REST endpoints `registerProcessDefinition` and `runProcessDefinition` require authentication but do not verify roles in the WorkflowService or in lower layers. An attacker with the `ROLE_USER` role can register and execute a process definition containing BeanShell scripts, allowing them to execute Java code and operating system commands with the service’s privileges. In the official Docker image, the process runs as root.","summary":"OpenKM Community Edition lets any user with the basic user role register and run a workflow definition that contains BeanShell scripts. The scripts execute Java code and operating system commands with the service's privileges, and the official Docker image runs that service as root.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"OpenKM Community Edition","fixed":[],"affected":"6.3.12, 6.3.13","ecosystem":"vendor"}],"ecosystems":[],"tags":["docker","java","jbpm","openkm","openkm-6.3","package","self-hosted"],"not_affected_if":["auth-required","openkm-7.x"],"how_to_check":"- Affected: OpenKM Community Edition 6.3.12 and 6.3.13 (the only versions INCIBE lists for this CVE). 7.x is not affected because it has no jBPM engine. Check the version on the About page or the image tag.\n- Check whether ordinary ROLE_USER accounts can reach /OpenKM/services/rest/workflow/* and /OpenKM/services/OKMWorkflow.\n- Docker: run 'docker exec <container> id -u'. 0 means the BeanShell code would run as root.\n- Also check 6.3.x builds older than 6.3.12 if you run them: INCIBE does not list them for this CVE, so their status is unconfirmed.","fix":"No fixed release yet: OpenKM CE 6.3.14 is announced as pending release and will require the administrator role to create or delete process definitions. 7.x does not include jBPM and is not affected (7.0.4 is the vendor's recommended migration target, per INCIBE).","status":"open","published_at":"2026-11-13T11:17:15+00:00","first_seen_at":"2026-11-13T11:44:16+00:00","triaged_at":"2026-11-13T11:44:31+00:00","updated_at":"2026-11-13T11:45:14+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T11:44:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"OpenKM Community: any logged-in user can run OS commands","impact":"high","summary":"OpenKM Community Edition lets any user with the basic user role register and run a workflow definition that contains BeanShell scripts. The scripts execute Java code and operating system commands with the service's privileges, and the official Docker image runs that service as root.","audience":"businesses","category":"package","nicknames":[],"who_cares":["openkm","java","docker","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs operating system commands as the service user, root in Docker","analyst_note":"Confirm affected version range and fixed version from the OpenKM advisory or NVD CPE data; the sources give no fix.","how_to_check":"- Check the OpenKM version deployed, for example in the application's About page or the image tag in the deployment manifest.\n- Check whether the REST endpoints `registerProcessDefinition` and `runProcessDefinition` are reachable by ordinary user accounts.\n- Check whether the container runs as root: `docker exec <container> id -u`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"Any OpenKM Community Edition installation where users hold the ROLE_USER role can reach the workflow REST endpoints, so any account, including low-privilege ones, can trigger the flaw. Installations that restrict workflow use to administrators or run the service without those endpoints exposed are less exposed. The sources do not list affected version ranges.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000754,"input_tokens":4611,"output_tokens":586,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected version range and fixed version from the OpenKM advisory or NVD CPE data; the sources give no fix.","search":"'-112182':19A,22A '-2026':18A,21A '-6.3':31B '6.3':3A 'allow':130C 'attack':114C 'authent':100C 'basic':44B 'beanshel':55B,128C 'code':61B,135C 'command':13A,65B,139C 'communiti':2A,37B,91C 'community':24A 'contain':54B,127C 'cve':17A,20A 'definit':16A,52B,88C,126C 'docker':26B,74B,148C 'edit':38B,92C 'edition':25A 'endpoint':95C 'execut':59B,123C,133C 'host':35B 'imag':75B,149C 'java':27B,60B,134C 'jbpm':28B 'layer':112C 'let':39B 'log':7A 'logged-in':6A 'lower':111C 'manag':85C 'offici':73B,147C 'openkm':1A,23A,29B,30B,36B,90C 'oper':63B,137C 'os':12A 'packag':32B 'privileg':70B,144C 'process':125C,151C 'regist':47B,121C 'registerprocessdefinit':96C 'requir':99C 'rest':94C 'role':46B,105C,117C,119C 'root':80B,154C 'run':11A,49B,76B,152C 'runprocessdefinit':98C 'script':56B,58B,129C 'self':34B 'self-host':33B 'servic':68B,78B,142C 'system':64B,138C 'unauthor':81C 'user':9A,41B,45B,118C 'verifi':104C 'vulner':82C 'workflow':15A,51B,87C 'workflowservic':108C 'x':4A","nicknames":[],"mitigations":[],"who_affected":"Self-hosted OpenKM Community Edition 6.3.12 and 6.3.13 installs (the 6.3 branch with the jBPM workflow engine) where any user has an ordinary account. Such a user can register a workflow containing BeanShell and run Java code and OS commands as the service account, which is root in the official Docker image. OpenKM 7.x does not include jBPM and is not affected. Anyone who cannot reach the workflow endpoints is not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["communityedition","openkmcommunityedition"],"ptokens":["community","edition","openkm"],"labels":["docker","high","java","jbpm","openkm","openkm63","package","selfhosted"],"campaign_type":null,"search_a":"'-112182':19A,22A '-2026':18A,21A '6.3':3A 'command':13A 'communiti':2A 'community':24A 'cve':17A,20A 'definit':16A 'edition':25A 'log':7A 'logged-in':6A 'openkm':1A,23A 'os':12A 'run':11A 'user':9A 'workflow':15A 'x':4A","search_b":"'-6.3':31B 'basic':44B 'beanshel':55B 'code':61B 'command':65B 'communiti':37B 'contain':54B 'definit':52B 'docker':26B,74B 'edit':38B 'execut':59B 'host':35B 'imag':75B 'java':27B,60B 'jbpm':28B 'let':39B 'offici':73B 'openkm':29B,30B,36B 'oper':63B 'packag':32B 'privileg':70B 'regist':47B 'role':46B 'root':80B 'run':49B,76B 'script':56B,58B 'self':34B 'self-host':33B 'servic':68B,78B 'system':64B 'user':41B,45B 'workflow':51B","search_c":"'allow':130C 'attack':114C 'authent':100C 'beanshel':128C 'code':135C 'command':139C 'communiti':91C 'contain':127C 'definit':88C,126C 'docker':148C 'edit':92C 'endpoint':95C 'execut':123C,133C 'imag':149C 'java':134C 'layer':112C 'lower':111C 'manag':85C 'offici':147C 'openkm':90C 'oper':137C 'privileg':144C 'process':125C,151C 'regist':121C 'registerprocessdefinit':96C 'requir':99C 'rest':94C 'role':105C,117C,119C 'root':154C 'run':152C 'runprocessdefinit':98C 'script':129C 'servic':142C 'system':138C 'unauthor':81C 'user':118C 'verifi':104C 'vulner':82C 'workflow':87C 'workflowservic':108C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T11:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-coordination@incibe.es","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112182","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112182","severity":null,"published_at":"2026-11-13T11:17:15+00:00","modified_at":"2026-11-13T11:17:15+00:00","first_seen_at":"2026-11-13T11:44:16+00:00","fetched_at":"2026-11-13T11:44:16+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112182:3875","url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-openkm-community-edition","severity":null,"published_at":"2026-11-13T11:45:14+00:00","modified_at":"2026-11-13T11:45:14+00:00","first_seen_at":"2026-11-13T11:45:14+00:00","fetched_at":"2026-11-13T11:45:14+00:00","note":"INCIBE-CERT advisory INCIBE-2026-895 read: 6.3.12/6.3.13 affected, 7.x not affected (no jBPM), fix 6.3.14 pending; vendor workaround: block non-admin access to /OpenKM/services/rest/workflow/* and /OpenKM/services/OKMWorkflow on proxy, or block /OpenKM/services/*. Not verified: INCIBE is a coordinator relay, no OpenKM page read. No PoC or exploitation found.","cites":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-openkm-community-edition"]}],"documents":[{"id":145529,"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-openkm-community-edition","title":"INCIBE-CERT: Multiple Vulnerabilities in OpenKM Community Edition","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}