Camunda 7 Authorization Flaw Lets Users Steal Task Data

Camunda has disclosed a missing authorization check in its workflow engine that exposes sensitive task data. The flaw allows authenticated attackers to bypass permission controls on specific endpoints.

What happened

The vulnerability, tracked as CVE-2026-109431, resides in the engine-rest task sub-resources of Camunda 7. According to the NVD record, it affects versions 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17. The issue stems from missing authorization checks on singular read and delete endpoints for task comments and attachments. These endpoints do not enforce the same filters that protect their corresponding list endpoints.

Attackers who have an authenticated account but no specific permission grants can exploit this gap. By calling methods such as getAttachment, getAttachmentData, deleteAttachment, and getComment, they can access data using only a known object ID. This allows them to read, download, or permanently delete task attachments and comments. The weaknesses are classified under CWE-862 and CWE-639.

Why it matters

This flaw is rated high severity with a CVSS score of 8.6. It undermines the integrity of task management by allowing unauthorized data exfiltration and deletion. Users who believe they are protected by role-based permissions may still be exposed if attackers discover object IDs. The impact includes loss of confidential attachments and irreversible deletion of task comments.

What to watch

• Monitor internal logs for unusual access patterns on task attachment and comment endpoints.
• Check for unauthorized deletions of task data in production environments.
• Verify that authentication mechanisms are not being used to bypass authorization checks.

Who needs to act first

Teams should prioritize systems that handle sensitive task data or external communications. Identify environments where authenticated users have minimal permissions but potential access to object IDs. Test for unauthorized access attempts in isolated staging areas before rolling out any changes. Back up critical task data to prevent permanent loss from malicious deletions. Review audit logs for signs of enumeration attacks targeting attachment and comment resources.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: Camunda

• Audit current Camunda 7 deployments to identify versions prior to 7.24.14 and 7.23.17.
• Restrict access to the engine-rest endpoints if immediate patching is not possible.
• Monitor authentication logs for users accessing task data without explicit permission grants.
• Prepare a rollback plan in case an update introduces compatibility issues with existing workflows.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Camunda versions are affected by CVE-2026-109431?

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 are affected.

What can an attacker do with this vulnerability?

They can read, download, or delete task attachments and comments using known object IDs.

Is there a fix available for this issue?

No fix has been confirmed yet in the provided source material.