Camunda 7: Incorrect authorization in first-run setup endpoint of Admin webapp
Summary
Camunda 7.24.0 before 7.24.15 contains an incorrect authorization flaw in the first-run setup endpoint of the Admin web application. The setup check only counts members of the default camunda-admin group and ignores administrators configured via adminUsers or adminGroups. If camunda-admin has no stored members in this configuration, an unauthenticated remote attacker can create a new administrator account, which can lead to account takeover and process deployment or script execution as the engine's service user. The condition is not the default configuration and requires a writable identity provider and network access to the Admin webapp.
Affected
- Camunda 7.24.0 to before 7.24.15 (CVE record; CodeAnt AI tested 7.24.0 and lists 7.24.0 to 7.24.14)
- VulDB describes the range as up to 7.24.14
- Default configuration: not affected according to the CVE record
Fixed in
- Camunda 7.24.15 (CVE record and CodeAnt AI research; released September 15, 2026)
- One aggregator names 7.24.16 as the fix; not verified against Camunda release notes
- Unknown: no Camunda vendor advisory found for this CVE
Workaround
- Restrict network access to the Admin webapp and especially to /camunda/api/admin/setup/ using firewall rules or a reverse proxy
- Check the stored membership of the camunda-admin group; a count of zero is a reason to investigate, not proof of exposure
- Restricting access is only a temporary measure until the fixed version is installed
Exploitation
- CISA SSVC: exploitation status 'poc', automatable 'no', technical impact 'total'
- A public technical write-up exists (CodeAnt AI, Camunda 7 Run 7.24.0)
- No exploitation in the wild found at the time of research
- CVSS 4.0 score 9.2 (Critical) per the CNA; CVSS 3.1 score 8.1 (High) per other sources
Our recommendation
- Check whether Camunda 7 versions 7.24.0 to 7.24.14 are in use, including Camunda 7 Run and webapp WAR files
- Upgrade to Camunda 7.24.15 or later and verify the fixed version against the Camunda download page
- Until then, restrict access to the Admin webapp and the setup endpoint
- Review the camunda-admin group membership and the administrator accounts for unexpected entries
- Monitor logs for unexpected setup requests and new administrator accounts
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CodeAnt AI security research: CVE-2026-77226 codeant.ai
- VulnCheck advisory: Camunda incorrect authorization via SetupResource www.vulncheck.com
- Camunda Enterprise download page docs.camunda.org
- Camunda security notices docs.camunda.org
- VulDB: CVE-2026-77226 vuldb.com
- ThreatInt CVE record summary cve.threatint.com
- Strix CVE summary www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:53.
Original description (NVD)
Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-admin group rather than recognizing all configured administrators. An unauthenticated remote attacker can exploit this logic flaw to call the setup user-create endpoint and create a new administrator account when the camunda-admin group is empty but the system is fully administered, resulting in account takeover and potential process deployment or script execution as the engine's service user.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.