---
id: "CVE-2026-78674"
kind: "vulnerability"
aliases: ["CVE-2026-78674"]
title: "BPMN System REST APIs: weak input validation allows authenticated command execution"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["bpmn", "command-execution", "other", "rest-api", "self-hosted"]
not_affected_if: ["auth-required"]
published_at: "2026-10-28T20:18:47+00:00"
first_seen_at: "2026-10-28T20:35:10+00:00"
updated_at: "2026-10-28T20:37:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78674", "first_seen_at": "2026-10-28T20:35:10+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-28T20:37:13+00:00"}]
---

# BPMN System REST APIs: weak input validation allows authenticated command execution

The BPMN System REST APIs do not validate input parameters well enough. A logged-in user can send crafted requests that run arbitrary commands on the server with the privileges of the product's runtime account.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-28T20:35:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-78674
- 2026-10-28T20:37:13+00:00 analyst — CVE published ~20 min ago; NVD page fetch returned empty and searches found no vendor advisory naming the product, affected versions or fix. Nothing verified; revisit once NVD/vendor text is indexed. Vendor not identified (not Flowable CVE-2026-91197 or Syncope; those are different CVEs). No exploitation or PoC seen.

## From the sources

The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server.

An authenticated user can leverage this vulnerability to execute arbitrary commands with the privileges of the product's runtime account. The scope of potential damage is contingent upon the permissions assigned to this account.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_