Camunda 7 EUVD-2026-104391

Requires a valid authenticated session to the Camunda engine-rest API (PR:L), but notably the attacker needs NO permission grants on the target task - this is the core defect. The attacker must know or guess the target's attachment or comment object ID, which is used as the sole access token by the vulnerable singular endpoints (getAttachment, getAttachmentData, deleteAttachment, getComment in TaskAttachmentResourceImpl/TaskCommentResourceImpl). Exploitation is limited to deployments exposing engine-rest to the attacker and running affected versions (7.24.0 before 7.24.14, or 7.23.0 before 7.23.17); the corresponding list endpoints are NOT exploitable because they correctly enforce authorization filtering. No non-default feature toggle is required - the flaw is in the default behavior of these singular sub-resource endpoints.

This is a genuine priority within affected environments rather than an inflated high-CVSS issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H) is internally consistent with the description: exploitation is network-reachable, low-complexity, requires low privileges (any authenticated user, even one with zero permission grants), and needs no user interaction, yielding high confidentiality and integrity impact. The signals reinforce rather than conflict: a publicly available exploit exists (CodeAnt security research), a vendor patch is available, and VulnCheck reported it, so exploitation is practically demonstrable and not merely theoretical. The one meaningful limiter is PR:L - an attacker must hold valid authentication to the engine-rest API, so this is primarily an insider / compromised-credential / over-broad-tenant exposure rather than a fully anonymous internet attack. No EPSS score was provided and the vulnerability is NOT in CISA KEV, so per precision rules the correct characterization is 'publicly available exploit code exists' with no evidence of active in-the-wild exploitation. The known-object-ID requirement (sequential/guessable attachment and comment IDs) lowers complexity in practice and is already reflected in AC:L. Net: treat as a real, patch-now authorization-bypass affecting data confidentiality and integrity of task attachments/comments.

A low-privileged authenticated Camunda user (e.g. an employee or a tenant lacking grants on a given task) directly calls singular engine-rest endpoints such as getAttachmentData or deleteAttachment using a known or guessed object ID, bypassing the authorization filtering that is only applied to the list endpoints. They read and download sensitive task attachments and comments belonging to other users, or permanently delete them. A public proof-of-concept documenting these TaskAttachmentResourceImpl/TaskCommentResourceImpl calls is available, and the low attack complexity plus network vector make this straightforward against any reachable Camunda 7 REST API.