CVE-2026-109433: camunda camunda 7 Incorrect Authorization

Vulnerability summary

CVE-2026-109433 is a medium (CVSS 6.5) Incorrect Authorization vulnerability in camunda camunda 7. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 19-10-2026
   PublishedVulnerability first disclosed.
2. 19-10-2026
   Last modifiedVulnerability information updated.

Description

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows authenticated attackers to bypass permission checks due to an inverted comparison logic in AbstractCockpitPluginResource.isPermissionDisabled(). Attackers with minimal Cockpit access can exploit a non-empty disabledPermissions configuration to read all process instances, process definitions, and incidents engine-wide without triggering any logging, regardless of their actual data grants.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.