CVE-2026-109431
8.1HighPublished 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-639, CWE-862
Impact
Authenticated users without permissions can view, download, or permanently delete task comments and attachments using predictable or known object IDs. They only need standard network access to the REST API and valid low-privileged credentials.
Root cause
Singular read and delete REST endpoints in TaskAttachmentResourceImpl and TaskCommentResourceImpl omit the authorization checks enforced on list endpoints.
Affected systems
Camunda 7.23.0 before 7.23.17, and Camunda 7.24.0 before 7.24.14
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Fix & remediation
Upgrade to Camunda 7.23.17, 7.24.14, or later. If patching immediately is not possible, restrict network access to the engine-rest task sub-resource endpoints (such as singular attachment and comment routes) via an API gateway or reverse proxy.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling singular read and delete endpoints that lack the authorization-filtered checks enforced on their corresponding list endpoints. Attackers can exploit TaskAttachmentResourceImpl and TaskCommentResourceImpl methods such as getAttachment, getAttachmentData, deleteAttachment, and getComment using only a known object ID to read, download, or permanently delete task attachments and comments.