---
id: "CVE-2026-112182"
page: "https://infrastack.ai/live/CVE-2026-112182"
kind: "vulnerability"
aliases: ["CVE-2026-112182"]
title: "OpenKM Community 6.3.x: any logged-in user can run OS commands through workflow definitions"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "OpenKM Community Edition", "fixed": [], "affected": "6.3.12, 6.3.13", "ecosystem": "vendor"}]
ecosystems: []
tags: ["docker", "java", "jbpm", "openkm", "openkm-6.3", "package", "self-hosted"]
not_affected_if: ["auth-required", "openkm-7.x"]
published_at: "2026-11-13T11:17:15+00:00"
first_seen_at: "2026-11-13T11:44:16+00:00"
updated_at: "2026-11-13T11:45:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112182", "first_seen_at": "2026-11-13T11:44:16+00:00"}, {"source": "analyst", "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-openkm-community-edition", "first_seen_at": "2026-11-13T11:45:14+00:00", "cites": ["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-openkm-community-edition"]}]
exploit_sources: []
---

# OpenKM Community 6.3.x: any logged-in user can run OS commands through workflow definitions

Link for people: https://infrastack.ai/live/CVE-2026-112182 (this .md is for agents)

OpenKM Community Edition lets any user with the basic user role register and run a workflow definition that contains BeanShell scripts. The scripts execute Java code and operating system commands with the service's privileges, and the official Docker image runs that service as root.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:OpenKM Community Edition affected 6.3.12, 6.3.13 fixed no fixed version listed

## How to check

- Affected: OpenKM Community Edition 6.3.12 and 6.3.13 (the only versions INCIBE lists for this CVE). 7.x is not affected because it has no jBPM engine. Check the version on the About page or the image tag.
- Check whether ordinary ROLE_USER accounts can reach /OpenKM/services/rest/workflow/* and /OpenKM/services/OKMWorkflow.
- Docker: run 'docker exec <container> id -u'. 0 means the BeanShell code would run as root.
- Also check 6.3.x builds older than 6.3.12 if you run them: INCIBE does not list them for this CVE, so their status is unconfirmed.

## Fix

No fixed release yet: OpenKM CE 6.3.14 is announced as pending release and will require the administrator role to create or delete process definitions. 7.x does not include jBPM and is not affected (7.0.4 is the vendor's recommended migration target, per INCIBE).

## Timeline

- 2026-11-13T11:44:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112182
- 2026-11-13T11:45:14+00:00 analyst https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-openkm-community-edition — INCIBE-CERT advisory INCIBE-2026-895 read: 6.3.12/6.3.13 affected, 7.x not affected (no jBPM), fix 6.3.14 pending; vendor workaround: block non-admin access to /OpenKM/services/rest/workflow/* and /OpenKM/services/OKMWorkflow on proxy, or block /OpenKM/services/*. Not verified: INCIBE is a coordinator relay, no OpenKM page read. No PoC or exploitation found.

## Documents

- [advisory] INCIBE-CERT: Multiple Vulnerabilities in OpenKM Community Edition https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-openkm-community-edition

## From the sources

Unauthorization vulnerability in the management of workflow definitions in OpenKM Community Edition. The REST endpoints `registerProcessDefinition` and `runProcessDefinition` require authentication but do not verify roles in the WorkflowService or in lower layers. An attacker with the `ROLE_USER` role can register and execute a process definition containing BeanShell scripts, allowing them to execute Java code and operating system commands with the service’s privileges. In the official Docker image, the process runs as root.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_