← Back to the live CVE advisory feed

CVE-2026-77226: Product identification pending

Severity

9.2 (CRITICAL)

Vendor

CAMUNDA

Affected versions

Before 7.24.15

Fixed version

7.24.15

Patch status

Patched

Published

2026-10-05T21:16:37.337

Modified

2026-10-05T21:16:37.337

Why it matters

This matters because the affected product may allow code execution. Prioritize systems that are internet-facing or have privileged access to other infrastructure.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Compare installed versions against the affected version range in the advisory.
• Treat internet-facing systems as higher priority.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-admin group rather than recognizing all configured administrators. An unauthenticated remote attacker can exploit this logic flaw to call the setup user-create endpoint and create a new administrator account when the camunda-admin group is empty but the system is fully administered, resulting in account takeover and potential process deployment or script execution as the engine's service user.

View the official NVD record for CVE-2026-77226

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.