Camunda 7.24.0 < 7.24.15 Incorrect Authorization via SetupResource Endpoint
Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-admin group rather than recognizing all configured administrators. An unauthenticated remote attacker can exploit this logic flaw to call the setup user-create endpoint and create a new administrator account when the camunda-admin group is empty but the system is fully administered, resulting in account takeover and potential process deployment or script execution as the engine's service user.
CVE-2026-77226
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-77226
Camunda 7
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Camunda",
"product": "Camunda 7",
"versions": [
{
"status": "affected",
"version": "7.24.0",
"lessThan": "7.24.15",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-77226
Source reference:
/cveMetadata/cveId
Publisher severity
critical
Source reference: /containers/cna/metrics
- Event
- #12035 · Revision 1
- Added to Heist Feed
- Publisher date