Vulnerability · Published Oct 5, 2026 · Assigned by VulnCheck

CVE-2026-77226Camunda 7.24.0 < 7.24.15 Incorrect Authorization via SetupResource Endpoint

High 8.1

In plain English

A high-severity incorrect authorization in Camunda 7 from Camunda. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.7%top 46.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-admin group rather than recognizing all configured administrators. An unauthenticated remote attacker can exploit this logic flaw to call the setup user-create endpoint and create a new administrator account when the camunda-admin group is empty but the system is fully administered, resulting in account takeover and potential process deployment or script execution as the engine's service user.

Affected products (as reported)

Vendor	Product	Versions
Camunda	Camunda 7	7.24.0 – before 7.24.15

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

CodeAnt AI Blog technical-description, exploit
Camunda Download Page product, patch
https://www.vulncheck.com/advisories/camunda-incorrect-authorization-via-setupresource-endpoint third-party-advisory