Authorization Flaw in OpenKM Community Edition Workflow Management

CVE-2026-112182

What is CVE-2026-112182?

An authorization flaw exists in OpenKM Community Edition's workflow management system. The affected REST endpoints, registerProcessDefinition and runProcessDefinition, require user authentication but do not properly validate the user's roles in the WorkflowService and deeper layers. This oversight allows an attacker with the nominal ROLE_USER to register and launch process definitions that contain BeanShell scripts, potentially executing arbitrary Java code and system commands with elevated privileges. Notably, in the official Docker implementation, such processes are executed with root access, raising significant security concerns.

References