Camunda 7: Missing authorization in task comment and attachment endpoints
Summary
Several REST endpoints for task comments and attachments in Camunda 7 skip the authorization check that their list endpoints apply. An authenticated user without any permission grants can read comment texts and attachments, and permanently delete attachments, if they know the relevant task ID and object ID. Authentication and authorization must be enabled in the engine for the flaw to apply, and the Community Edition may not receive a fix.
Affected
- Camunda 7.24.0 to before 7.24.14
- Camunda 7.23.0 to before 7.23.17
- Versions before 7.23.0: Unknown.
Fixed in
- Camunda 7.24.14
- Camunda 7.23.17
- Camunda 7 Community Edition: patch availability Unknown (the Community Edition is End of Life).
Workaround
Unknown. No vendor-documented workaround has been identified.
Exploitation
- CISA SSVC: exploitation status 'poc' (public proof of concept), not automatable, total technical impact.
- Attack requires an authenticated account and knowledge of valid task and object IDs.
- IDs are not enumerable through the API according to the researchers.
Our recommendation
- Update Camunda 7 Enterprise to 7.24.14 or 7.23.17, or the fixed release of your branch.
- If you run the Community Edition, check whether a patch is available. Otherwise plan a migration or apply a local patch.
- Review which accounts can authenticate to the engine REST API and remove unneeded access.
- Check audit logs for unexpected reads or deletions of task comments and attachments.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-109431 Security Research (CodeAnt AI) codeant.ai
- VulnCheck advisory: Camunda Missing Authorization in Task Sub-Resources www.vulncheck.com
- VulDB entry CVE-2026-109431 vuldb.com
- Camunda Enterprise Download docs.camunda.org
- Camunda security notices docs.camunda.org
- Camunda 7 Enterprise end-of-life extension camunda.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:48.
Original description (NVD)
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling singular read and delete endpoints that lack the authorization-filtered checks enforced on their corresponding list endpoints. Using only a known object ID, attackers can exploit TaskAttachmentResourceImpl and TaskCommentResourceImpl methods such as getAttachment, getAttachmentData, deleteAttachment, and getComment to read or download task attachments and comments and to permanently delete task attachments.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.