CVE-2026-109431: Camunda 7 7.24.0 to before 7.24.14, 7.23.0 to before 7.23.17

Affected technology

Camunda 7 · 7.24.0 to before 7.24.14, 7.23.0 to before 7.23.17
Camunda

Description’s affected range: before 7.24.14 and 7.23.0 before 7.23.17

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Authenticated attackers with no permission grants can access task comments and attachments by calling singular read and delete endpoints that lack the authorization-filtered checks enforced on their corresponding list endpoints. Vendor/CNA’s CVSS 4.0 assessment (base score 8.6/10) rates confidentiality and integrity impact as high; availability impact as none.