CVE-2026-77226 in Camunda
Summary
by MITRE • 10/06/2026
Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-admin group rather than recognizing all configured administrators. An unauthenticated remote attacker can exploit this logic flaw to call the setup user-create endpoint and create a new administrator account when the camunda-admin group is empty but the system is fully administered, resulting in account takeover and potential process deployment or script execution as the engine's service user.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified in Camunda versions prior to 7.24.15 represents a critical logic flaw within the Admin web application’s first-run setup mechanism. Specifically, the SetupResource endpoint responsible for determining whether the system has been initialized and configured contains an incorrect authorization check. This function erroneously relies on counting only the direct members of the camunda-admin group to ascertain if administrative privileges have already been established. In environments where the camunda-admin group is empty or lacks explicit direct membership entries, despite the presence of other valid administrator configurations such as role-based assignments or nested group memberships, the system incorrectly perceives itself as unconfigured and in need of initial setup. This misconfiguration allows an attacker to bypass intended access controls by exploiting this specific logical gap during the initialization phase.
From a technical perspective, the flaw stems from an insufficient verification process that fails to account for all possible methods of administrative configuration within the Camunda platform. By strictly checking for direct group membership rather than evaluating the broader set of configured administrators or effective permissions, the application creates a window of opportunity for unauthorized access. An unauthenticated remote attacker can leverage this condition by sending crafted requests to the setup user-create endpoint. Since the system believes it is in its initial state and requires an administrator account creation, it processes these requests without requiring authentication credentials that would normally be enforced once proper administrative accounts are established. This behavior effectively neutralizes the security boundary intended for post-initialization states.
The operational impact of this vulnerability is severe, leading directly to unauthorized account takeover. Once exploited, the attacker can create a new administrator account with full privileges equivalent to those held by legitimate system administrators. With these elevated permissions, an adversary gains the ability to deploy malicious processes or scripts onto the Camunda engine. This capability poses significant risks including data exfiltration, manipulation of business workflows, and potential execution of arbitrary code as the service user running the application. The compromise extends beyond mere access control failure; it enables persistent backdoor installation and deep integration into the enterprise’s workflow automation infrastructure, potentially affecting downstream systems connected to or triggered by Camunda processes.
This vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting failures in authorization logic where role-based permissions are not correctly evaluated against all configured administrative entities. Furthermore, it maps to MITRE ATT&CK techniques related to Initial Access and Privilege Escalation, particularly the exploitation of misconfigured access controls during system initialization phases. The attack vector is classified as remote with no additional prerequisites for authentication, making it highly exploitable in internet-facing deployments or internal networks where lateral movement might follow initial compromise.
To mitigate this risk, organizations running Camunda versions between 7.24.0 and 7.24.15 must immediately upgrade to version 7.24.15 or later, which corrects the authorization logic in SetupResource to properly recognize all configured administrators regardless of group membership structure. Until patching is feasible, temporary mitigations include restricting network access to the Admin web application endpoints via firewall rules or reverse proxy configurations, ensuring that only trusted IP addresses can reach the setup and administrative interfaces. Additionally, verifying that no empty camunda-admin groups exist without corresponding direct administrator assignments can reduce exposure during the transition period. Regular audits of user roles and group memberships are recommended to ensure alignment with organizational security policies and prevent similar logic flaws from being exploited in future updates or custom configurations.