{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/camunda-platform-7.24.0-7.24.13-7.23.0-7.23.16/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:camunda:camunda_platform:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-109431"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Camunda Platform (7.24.0-7.24.13, 7.23.0-7.23.16)"],"_cs_severities":["high"],"_cs_tags":["authorization-bypass","api-security","cve-2026-109431"],"_cs_type":"advisory","_cs_vendors":["Camunda"],"content_html":"\u003cp\u003eCamunda Platform versions 7.24.0 through 7.24.13 and 7.23.0 through 7.23.16 contain a missing authorization check vulnerability (CVE-2026-109431) within the engine-rest API. This flaw resides in TaskAttachmentResourceImpl and TaskCommentResourceImpl sub-resources, where singular read and delete endpoints fail to enforce the authorization-filtered checks that are present in corresponding list-based endpoints.\u003c/p\u003e\n\u003cp\u003eAn authenticated attacker with insufficient permissions can exploit this vulnerability to interact with task comments and attachments by providing a known object identifier. This allows unauthorized retrieval, download, or permanent deletion of sensitive business process data. Because the vulnerability involves bypassing established security logic for singular resources, it allows for targeted data exfiltration or disruption of task-related workflows. Defenders should prioritize patching, as this vulnerability enables unauthorized data access without requiring elevated privileges.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows authenticated, unauthorized users to view, download, or delete task-related attachments and comments. This poses a significant risk to data confidentiality and integrity within enterprise business processes, as attackers can exfiltrate sensitive files or sabotage administrative tasks by removing attachments or comments across the organization.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to Camunda Platform version 7.24.14 or 7.23.17 to remediate CVE-2026-109431.\u003c/li\u003e\n\u003cli\u003eAudit access logs for unauthorized attempts to access engine-rest/task endpoints containing /attachment/ or /comment/ where the requesting user lacks standard task visibility permissions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T18:08:25Z","date_published":"2026-10-19T18:08:25Z","id":"https://feed.craftedsignal.io/briefs/2026-10-camunda-auth-bypass/","summary":"An authorization bypass vulnerability in Camunda Platform allows authenticated attackers to access, download, or delete task comments and attachments by exploiting missing authorization checks in specific engine-rest sub-resources.","title":"Authorization Bypass in Camunda Platform Task Resources","url":"https://feed.craftedsignal.io/briefs/2026-10-camunda-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Camunda Platform (7.24.0-7.24.13, 7.23.0-7.23.16)","version":"https://jsonfeed.org/version/1.1"}