---
id: CVE-2026-109433
title: Camunda Broken Access Control via Cockpit
summary: >-
  Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an
  authorization bypass vulnerability in the Cockpit webapp that allows
  authenticated attackers to bypass permission checks due to an inverted
  comparison logic in AbstractC…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-863
vendor: Camunda
product: Camunda 7
affected:
  - 7 >= 7.24.0 < 7.24.14
  - 7 >= 7.23.0 < 7.23.17
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-19T16:42:07.642487Z'
exploitAvailable: true
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T16:42:30.955Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-109433'
references:
  - url: >-
      https://codeant.ai/security-research/camunda-cockpit-disabled-permissions-cve-2026-109433
    label: CodeAnt AI Blog
  - url: 'https://docs.camunda.org/enterprise/download/'
    label: Camunda Download Page
  - url: >-
      https://www.vulncheck.com/advisories/camunda-broken-access-control-via-cockpit
    label: 'VulnCheck Advisory: Camunda Broken Access Control via Cockpit'
tags:
  - cve.org
  - exploit-available
ingestedAt: '2026-10-19T15:31:18.956Z'
---

## Overview

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows authenticated attackers to bypass permission checks due to an inverted comparison logic in AbstractCockpitPluginResource.isPermissionDisabled(). Attackers with minimal Cockpit access can exploit a non-empty disabledPermissions configuration to read all process instances, process definitions, and incidents engine-wide without triggering any logging, regardless of their actual data grants.

## Affected

- `7 >= 7.24.0 < 7.24.14`
- `7 >= 7.23.0 < 7.23.17`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.