{"id":"CVE-2026-78674","kind":"vulnerability","aliases":["CVE-2026-78674"],"related":[],"title":"BPMN System REST APIs: weak input validation allows authenticated command execution","description":"The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server.\n\nAn authenticated user can leverage this vulnerability to execute arbitrary commands with the privileges of the product's runtime account. The scope of potential damage is contingent upon the permissions assigned to this account.","summary":"The BPMN System REST APIs do not validate input parameters well enough. A logged-in user can send crafted requests that run arbitrary commands on the server with the privileges of the product's runtime account.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bpmn","command-execution","other","rest-api","self-hosted"],"not_affected_if":["auth-required"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-28T20:18:47+00:00","first_seen_at":"2026-10-28T20:35:10+00:00","triaged_at":"2026-10-28T20:36:03+00:00","updated_at":"2026-10-28T20:37:13+00:00","category":"other","confidence":0.3,"triage":{"at":"2026-10-28T20:36:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"BPMN System REST APIs: weak input validation allows authenticated command execution","impact":"high","summary":"The BPMN System REST APIs do not validate input parameters well enough. A logged-in user can send crafted requests that run arbitrary commands on the server with the privileges of the product's runtime account.","category":"other","nicknames":[],"who_cares":["bpmn","self-hosted"],"confidence":0.5,"needs_auth":"yes","worst_case":"Authenticated user runs arbitrary commands on the server as runtime account","analyst_note":"Sources list only the NVD entry; find the vendor advisory or product name, affected versions and fixed release at https://nvd.nist.gov/vuln/detail/CVE-2026-78674.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000512,"input_tokens":3343,"output_tokens":356,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources list only the NVD entry; find the vendor advisory or product name, affected versions and fixed release at https://nvd.nist.gov/vuln/detail/CVE-2026-78674.","search":"'-2026':13A,16A '-78674':14A,17A 'account':65B,115C,129C 'allow':8A,77C 'api':4A,25B,33B,70C 'arbitrari':52B,91C,105C 'assign':126C 'authent':9A,78C,97C 'bpmn':1A,18B,30B,67C 'command':10A,20B,53B,92C,106C 'command-execut':19B 'conting':122C 'craft':48B,82C 'cve':12A,15A 'damag':120C 'enough':40B 'execut':11A,21B,89C,104C 'host':28B 'input':6A,37B,75C 'lead':86C 'leverag':100C 'log':43B 'logged-in':42B 'paramet':38B,76C 'permiss':125C 'potenti':119C 'privileg':59B,109C 'product':62B,112C 'request':49B,83C 'rest':3A,24B,32B,69C 'rest-api':23B 'run':51B 'runtim':64B,114C 'scope':117C 'self':27B 'self-host':26B 'send':47B 'server':56B,95C 'submit':81C 'suffici':73C 'system':2A,31B,68C 'upon':123C 'user':45B,79C,98C 'valid':7A,36B,74C 'vulner':102C 'weak':5A 'well':39B","nicknames":[],"mitigations":[],"who_affected":"Only systems running the unidentified product that exposes the BPMN System REST APIs are affected, and an attacker needs a valid login. If you run a BPMN or workflow product, check which vendor ships a component named 'BPMN System' and whether its REST API is reachable by users you do not fully trust. Deployments where no untrusted users can log in are at lower risk, but the commands run as the product's service account.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T20:18:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"ed10eef1-636d-4fbe-9993-6890dfa878f8","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-78674","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78674","severity":null,"published_at":"2026-10-28T20:18:47+00:00","modified_at":"2026-10-28T20:18:47+00:00","first_seen_at":"2026-10-28T20:35:10+00:00","fetched_at":"2026-10-28T20:35:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-78674:978","url":null,"severity":null,"published_at":"2026-10-28T20:37:13+00:00","modified_at":"2026-10-28T20:37:13+00:00","first_seen_at":"2026-10-28T20:37:13+00:00","fetched_at":"2026-10-28T20:37:13+00:00","note":"CVE published ~20 min ago; NVD page fetch returned empty and searches found no vendor advisory naming the product, affected versions or fix. Nothing verified; revisit once NVD/vendor text is indexed. Vendor not identified (not Flowable CVE-2026-91197 or Syncope; those are different CVEs). No exploitation or PoC seen."}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}