EUVD-2026-92791
GHSA-mx4r-g275-wg5r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate exposed Camunda Admin setup endpoint
-
DeliverySend unauthenticated user-create setup request
-
ExploitBypass authorization via empty-group miscount
-
ExecutionCreate new administrator account
-
ImpactAuthenticate and deploy process/script as engine service user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable only when the camunda-admin group contains zero direct members while the system is nevertheless fully administered (administrators assigned through configured authorizations rather than group membership); under this specific state SetupResource wrongly concludes no admin exists and re-enables the first-run setup user-create endpoint. The endpoint must be network-reachable (Admin web application exposed). This is reflected by AT:P - it is NOT a default-configuration remote takeover. Limiting factors: the empty-direct-membership-but-administered edge state is non-default and must already exist; no authentication or user interaction is required once that condition holds (PR:N/UI:N); affected versions are Camunda 7.24.0 through 7.24.14 (fixed in 7.24.15). |
| Impact | This is a genuine high-priority issue for affected Camunda deployments, not merely a high-CVSS paper risk. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms a network-reachable, unauthenticated, low-complexity flaw with high confidentiality, integrity, and availability impact, scoring 9.2 (Critical). The critical nuance is AT:P (Attack Requirements: Present): exploitation is NOT universally reachable - it requires the specific state where the camunda-admin group is empty yet the system is otherwise fully administered (e.g., admins assigned via authorizations rather than direct group membership). This materially narrows the exploitable population versus the raw score. No EPSS score, no CISA KEV listing, and no confirmed public exploit were provided; per rules this is 'no public exploit identified at time of analysis,' though a detailed third-party technical writeup (codeant.ai) and a VulnCheck advisory exist, which often precede or accompany PoC development. Signals are internally consistent (CWE-863 Incorrect Authorization matches the described group-counting logic flaw). Missing data to flag explicitly: EPSS probability is absent so widespread-scanning likelihood is unquantified, and KEV absence means no evidence of active exploitation yet - treat as a conditional critical that should be patched promptly where the empty-admin-group condition can occur. |
| Exploit ScenarioDerived | An attacker reaches an internet- or network-exposed Camunda Admin web application where the camunda-admin group has no direct members (though administrators are configured by other means). Because SetupResource miscounts administrators, it still exposes the first-run setup endpoint; the attacker calls the user-create setup API without authentication to create a new administrator account. No public exploit was identified at time of analysis, but the flaw is low-complexity once the empty-group precondition is met. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Incorrect authorization in the Camunda 7 Admin web application (7.24.0 through 7.24.14) lets an unauthenticated remote attacker reach the first-run setup user-create endpoint and create a new administrator account, enabling account takeover and, via admin-level process deployment or scripting, code execution as the workflow engine's service user (CWE-863, CVSS 9.2). Exploitation is not default-configuration remote takeover: the setup endpoint only becomes reachable when the camunda-admin group contains zero direct members while the deployment is nonetheless fully administered through configured authorizations, which is why the assessed CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N and the CVSS 4.0 vector carries AT:P. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed version, 7.24.15.
RemediationAI
Vendor-released patch: upgrade to Camunda 7.24.15, the first fixed release for the 7.24 line, using the enterprise download page referenced in the advisory (https://docs.camunda.org/enterprise/download/); see also the VulnCheck advisory (https://www.vulncheck.com/advisories/camunda-incorrect-authorization-via-setupresource-endpoint) and the technical analysis at https://codeant.ai/security-research/camunda-empty-admin-group-cve-2026-77226. If an immediate upgrade is not possible, eliminate the exploitable edge state rather than relying on generic hardening: ensure at least one user is a direct member of the camunda-admin group so SetupResource's membership count is non-zero (trade-off: introduces a group-based admin identity that must be provisioned, rotated and kept consistent with existing authorization-based admin assignments, and it does not fix the underlying logic bug). In parallel, restrict network reachability of the Admin web application and its first-run setup/user-create route at the reverse proxy, load balancer or WAF to trusted administrative networks only (trade-off: legitimate initial provisioning and admin workflows from remote or VPN-adjacent networks must be re-routed, and any proxy rule must match the exact endpoint path to avoid bypass). Do not expose the Admin webapp directly to the internet in the meantime. Treat any deployment that had an empty camunda-admin group with authorization-based admins as potentially compromised: audit Admin audit logs and the identity store for unexpected administrator accounts or new users, review recently deployed or modified process definitions, script tasks and connectors for attacker-introduced logic, and rotate credentials for the engine's service user and any datastore the engine can reach, since an attacker holding admin rights could have executed code with those privileges.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Camunda 7 (Camunda Platform 7) is a Java-based BPMN/DMN workflow and decision engine shipped with a bundled Admin web application used for user, group, authorization and engine administration. CVE-2026-77226 is a CWE-863 incorrect authorization flaw in the Admin app's first-run setup logic: SetupResource decides whether initial setup is still available by counting only direct members of the camunda-admin group instead of evaluating the effective administrator set, so deployments where administrative rights are granted through configured authorizations (rather than group membership) are misclassified as unconfigured. That misclassification re-exposes the setup user-create endpoint, which then permits creation of a new administrator account without prior authentication (PR:N in both the vendor's CVSS 4.0 vector and the assessed CVSS 3.1 vector). The root-cause class is an authorization decision based on an incomplete/inappropriate data source rather than effective permissions; the precondition that the group is empty while the system is administered is non-default, which is captured by AT:P in the CVSS 4.0 vector and by AC:H in the independently assessed CVSS 3.1 vector. Successful account creation yields full Admin privileges, and from there the attacker can deploy or modify process definitions whose script tasks, expression language or connectors execute with the privileges of the engine's service user, potentially reaching host-level resources or downstream systems; the exploitability therefore hinges on network reachability of the Admin web application, not on credentials.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable and unauthenticated (AV:N/PR:N), but AC:H because exploitation depends on the specific non-default empty-admin-group state outside attacker control; admin takeover yields full C/I/A impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-admin group rather than recognizing all configured administrators. An unauthenticated remote attacker can exploit this logic flaw to call the setup user-create endpoint and create a new administrator account when the camunda-admin group is empty but the system is fully administered, resulting in account takeover and potential process deployment or script execution as the engine's service user.
Executive ViewAI
Organizations running self-managed Camunda 7 deployments on versions 7.24.0 through 7.24.14 may be exposed to an unauthenticated attacker creating a rogue administrator account through the Admin web application's first-run setup endpoint, which can lead to full control of the workflow engine and code execution under its service account. The exposure is not universal: it only materializes in deployments where the camunda-admin group has no direct members yet administration is granted entirely through configured authorizations, a configuration that may exist quietly in mature environments. Because the resulting access is administrative over business-critical process automation, leadership should treat this as a potential integrity and data-exposure risk to workflow operations, not merely an application misconfiguration.
Apply vendor patch. If upgrade to 7.24.15 cannot be completed immediately, populate the camunda-admin group with at least one direct member to close the first-run setup path, and restrict network reachability of the Camunda Admin web application to trusted administrative networks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB