CVE-2026-109431: Missing Authorization in Camunda Camunda 7

This vulnerability affects Camunda 7.23.0 up to but not including 7.23.17 and 7.24.0 up to but not including 7.24.14. The issue is a missing authorization check in the engine-rest task sub-resources, particularly in TaskAttachmentResourceImpl and TaskCommentResourceImpl methods such as getAttachment, getAttachmentData, deleteAttachment, and getComment. Authenticated attackers without permission grants can exploit these endpoints by using known object IDs to read, download, or permanently delete task attachments and comments. The list endpoints enforce authorization filtering, but the singular read and delete endpoints do not, leading to unauthorized access.

An attacker with authentication but no specific permission grants can access sensitive task comments and attachments, potentially leading to unauthorized disclosure or deletion of information within Camunda 7 task management. This could affect confidentiality and integrity of task-related data.

A fix is available in Camunda 7.23.17 and 7.24.14 that addresses the missing authorization checks. Users should upgrade to these versions or later to remediate this vulnerability. No additional mitigation steps are indicated beyond applying the official patches.