CVE-2026-41854 vulnerabilities

Vulnerabilities for packages: camunda-zeebe...

GHSA-7M2P-62GW-P8QQ vulnerabilities

Vulnerabilities for packages: camunda-zeebe...

CVE-2026-109433

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows authenticated attackers to bypass permission checks due to an inverted comparison logic in AbstractCockpitPluginResource.isPermissionDisabled. Attackers with...

CVE-2026-109431

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling singular read and delete endpoints that...

CVE-2026-109432

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the...

CVE-2026-109433

Camunda versions 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 are vulnerable to an authorization bypass in the Cockpit webapp . The root cause is an inverted comparison logic within the AbstractCockpitPluginResource.isPermissionDisabled() method. Authenticated attackers with minimal Cockpit ac...

EUVD-2026-104393

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows authenticated attackers to bypass permission checks due to an inverted comparison logic in AbstractCockpitPluginResource.isPermissionDisabled. Attackers with...

CVE-2026-109433 Camunda Broken Access Control via Cockpit

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows authenticated attackers to bypass permission checks due to an inverted comparison logic in AbstractCockpitPluginResource.isPermissionDisabled. Attackers with...

CVE-2026-109433 Camunda Broken Access Control via Cockpit

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows authenticated attackers to bypass permission checks due to an inverted comparison logic in AbstractCockpitPluginResource.isPermissionDisabled. Attackers with...

CVE-2026-109432 Camunda Expression Injection via orQueries RCE

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the...

EUVD-2026-104392

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the...

CVE-2026-109432 Camunda Expression Injection via orQueries RCE

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the...

CVE-2026-109432

Camunda versions 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 are vulnerable to an expression injection flaw. The root cause is that AdhocQueryValidator.validate() fails to inspect sub-query expression maps within the orQueries field of TaskQueryDto . This allows authenticated users to bypass ...

CVE-2026-109431

Camunda versions 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 are vulnerable to a missing authorization check in the engine-rest task sub-resources. The flaw resides in the TaskAttachmentResourceImpl and TaskCommentResourceImpl methods, specifically affecting getAttachment , getAttachmentData ...

CVE-2026-109431 Camunda Missing Authorization in Task Sub-Resources

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling singular read and delete endpoints that...

EUVD-2026-104391

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling singular read and delete endpoints that...

CVE-2026-109431 Camunda Missing Authorization in Task Sub-Resources

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling singular read and delete endpoints that...

PT-2026-117447

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling singular read and delete endpoints that...

PT-2026-117448

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the...

PT-2026-117449

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows authenticated attackers to bypass permission checks due to an inverted comparison logic in AbstractCockpitPluginResource.isPermissionDisabled. Attackers with...