CVE-2026-77226: Incorrect Authorization in Camunda Camunda 7
Description
Camunda 7 versions 7.24.0 through 7.24.14 contain an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint. This flaw allows an unauthenticated remote attacker to create a new administrator account if the camunda-admin group is empty, even when the system is fully administered. Exploitation can lead to account takeover and potentially allow process deployment or script execution as the engine's service user.
CVSS v4.0
Score 9.2critical
Affected software
Camunda
Camunda 7
pkg:maven/org.camunda.bpm/camunda-bpm-platformRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-77226 is an incorrect authorization vulnerability in Camunda 7's Admin web application first-run setup endpoint. The SetupResource component incorrectly determines setup availability by counting only direct members of the camunda-admin group, ignoring all configured administrators. This logic flaw enables an unauthenticated remote attacker to invoke the setup user-create endpoint and create a new administrator account when the camunda-admin group is empty, despite the system being fully administered. The vulnerability affects versions from 7.24.0 up to but not including 7.24.15.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to create a new administrator account, resulting in account takeover. This can lead to unauthorized process deployment or script execution with the privileges of the engine's service user, posing a critical risk to the confidentiality, integrity, and availability of the affected system.
Mitigation Recommendations
A fix is available in Camunda version 7.24.15. Users should upgrade to version 7.24.15 or later to remediate this vulnerability. Patch status is confirmed by the affected version range indicating the fix in 7.24.15.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-20T18:25:46.944Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ac415492cdf04f6563b29ef
Added to database: 10/05/2026, 21:23:21 UTC
Last enriched: 10/05/2026, 21:33:14 UTC
Last updated: 10/05/2026, 21:33:14 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.