CVE-2026-109433: Incorrect Authorization in Camunda Camunda 7

Camunda 7 versions 7.23.0 through before 7.23.17 and 7.24.0 through before 7.24.14 contain an authorization bypass vulnerability in the Cockpit webapp. The issue is due to inverted comparison logic in AbstractCockpitPluginResource.isPermissionDisabled(), which causes permission checks to be bypassed when a non-empty disabledPermissions configuration is present. This enables authenticated attackers with minimal Cockpit access to read all process instances, process definitions, and incidents engine-wide without logging, regardless of their actual data permissions.

Authenticated users with minimal access to the Cockpit webapp can bypass permission checks and gain unauthorized read access to all process instances, process definitions, and incidents across the engine. This unauthorized access occurs without generating any logging events, potentially allowing stealthy data exposure. The vulnerability compromises confidentiality of process-related data within affected Camunda 7 deployments.

A fix is available in Camunda 7.23.17 and 7.24.14. Users should upgrade affected versions to these fixed releases or later to remediate the authorization bypass vulnerability. No additional mitigations are specified in the advisory.