Camunda 7
Monthly
Authenticated expression injection in Camunda 7 (7.24.0 through 7.24.13 and 7.23.0 through 7.23.16) lets a user who can reach the ad-hoc task-query API bypass the enableExpressionsInAdhocQueries restriction and execute arbitrary OS commands as the engine service account. The validator does not inspect sub-query expression maps in TaskQueryDto.orQueries, so a crafted JUEL expression can trigger Java reflection and Runtime.exec. Publicly available exploit code exists; the vendor has released fixed versions 7.24.14 and 7.23.17, and CISA KEV status is not indicated.
Missing authorization checks in Camunda 7's engine-rest task sub-resources allow any authenticated user to read, download, or permanently delete task comments and attachments without holding any permission grant on the target task. Versions 7.24.0 through 7.24.13 and 7.23.0 through 7.23.16 are affected; the attacker only needs a valid session and the target comment or attachment object ID. Publicly available exploit code exists and the issue is rated 8.6 under CVSS 4.0, making this a genuine priority for deployments that expose engine-rest.
Authorization bypass in Camunda 7 Cockpit allows authenticated users with minimal Cockpit access to read all process instances, process definitions, and incidents engine-wide without logging when the engine has a non-empty disabledPermissions configuration. Affected versions are Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17. Publicly available exploit code exists, and a vendor patch is available; exploitation requires both valid Cockpit credentials and the non-default non-empty disabledPermissions setting, so exposure is configuration-dependent.
Authenticated expression injection in Camunda 7 (7.24.0 through 7.24.13 and 7.23.0 through 7.23.16) lets a user who can reach the ad-hoc task-query API bypass the enableExpressionsInAdhocQueries restriction and execute arbitrary OS commands as the engine service account. The validator does not inspect sub-query expression maps in TaskQueryDto.orQueries, so a crafted JUEL expression can trigger Java reflection and Runtime.exec. Publicly available exploit code exists; the vendor has released fixed versions 7.24.14 and 7.23.17, and CISA KEV status is not indicated.
Missing authorization checks in Camunda 7's engine-rest task sub-resources allow any authenticated user to read, download, or permanently delete task comments and attachments without holding any permission grant on the target task. Versions 7.24.0 through 7.24.13 and 7.23.0 through 7.23.16 are affected; the attacker only needs a valid session and the target comment or attachment object ID. Publicly available exploit code exists and the issue is rated 8.6 under CVSS 4.0, making this a genuine priority for deployments that expose engine-rest.
Authorization bypass in Camunda 7 Cockpit allows authenticated users with minimal Cockpit access to read all process instances, process definitions, and incidents engine-wide without logging when the engine has a non-empty disabledPermissions configuration. Affected versions are Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17. Publicly available exploit code exists, and a vendor patch is available; exploitation requires both valid Cockpit credentials and the non-default non-empty disabledPermissions setting, so exposure is configuration-dependent.