Authorization Bypass in Camunda Cockpit Webapp
CVE-2026-109433

6MEDIUM

Key Information:

Vendor: Camunda
Status: Camunda 7
Vendor: CVE Published:; 19 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-109433?

The Cockpit web application in Camunda suffers from an authorization bypass vulnerability, where authenticated attackers can exploit inverted logic in the permission check function. This flaw allows them to gain unauthorized access to sensitive data such as process instances and definitions, as well as incident logs, without generating any logs of their actions. Minimal access to the Cockpit interface is sufficient, especially if the disabledPermissions configuration is non-empty, to bypass intended access restrictions.

Affected Version(s)

Camunda 7 7.24.0 < 7.24.14

Camunda 7 7.23.0 < 7.23.17

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-109433 - Proof of Concept