CVE-2026-77226

Name of the Vulnerable Software and Affected Versions Camunda versions 7.24.0 through 7.24.14

Description An incorrect authorization issue exists in the Admin web application's first-run setup endpoint. The SetupResource incorrectly determines if the setup process is available by counting only direct members of the camunda-admin group instead of recognizing all configured administrators. An unauthenticated remote attacker can exploit this logic flaw to access the setup user-create endpoint and create a new administrator account if the camunda-admin group is empty, even if the system is already fully administered. This can lead to account takeover, unauthorized process deployment, or script execution as the engine's service user.

Recommendations Update Camunda to version 7.24.15.