Description

Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-admin group rather than recognizing all configured administrators. An unauthenticated remote attacker can exploit this logic flaw to call the setup user-create endpoint and create a new administrator account when the camunda-admin group is empty but the system is fully administered, resulting in account takeover and potential process deployment or script execution as the engine's service user.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-10-05T21:16:37.337Z",
  "pubdate": "2026-10-05T21:16:37.337Z",
  "executiveSummary": "The Camunda 7.24.0 through 7.24.14 product versions are susceptible to an incorrect authorization vulnerability within the Admin web application's first-run setup endpoint.\nThe flaw originates from an improper verification logic in the SetupResource component, which incorrectly assesses whether the system has been initialized by only checking for direct members of the camunda-admin group.\nThis logic error allows an unauthenticated remote attacker to bypass initialization checks when the camunda-admin group is empty, even if the system is otherwise fully configured with alternative administrative users.\nSuccessful exploitation enables an attacker to invoke the user-create endpoint, facilitating the unauthorized creation of a new administrator account.\nThis leads to a complete system compromise, granting the attacker administrative privileges over the Camunda engine, including the ability to deploy unauthorized BPMN processes and execute arbitrary scripts as the engine's service user, posing a critical risk to data integrity and system security.",
  "technicalDetails": "The vulnerability resides in the SetupResource component of the Camunda Admin web application, specifically within the logic governing the detection of the system's initialization state.\nThe root cause is an insecure determination of setup availability; the system queries the identity service for direct members of the default 'camunda-admin' group to decide if the setup phase has been completed. If this specific group is empty, the application incorrectly flags the environment as 'uninitialized', regardless of whether other users or external identity providers have been correctly configured as administrators.\nThe attack flow begins with an unauthenticated remote attacker identifying a target instance where the 'camunda-admin' group does not contain direct members. By navigating to the SetupResource endpoints, the attacker confirms the availability of the first-run installation screens.\nThe attacker then crafts a request to the user-create endpoint. Because the application logic incorrectly perceives the system as uninitialized, it permits the creation of a new administrative user without requiring prior authentication or administrative authorization.\nUpon successful creation of the malicious account, the attacker gains full administrative access to the Camunda web interface. This allows the attacker to bypass access control lists (ACLs) and interact with engine-level functionalities.\nThe impact of this exploit is severe, as an administrative user can perform critical operations, including the deployment of arbitrary BPMN/DMN processes. Since these processes run under the context of the engine's service user, the attacker can leverage scripts, listeners, or service tasks to execute arbitrary code or commands on the underlying host infrastructure. This essentially grants the attacker full control over the process engine and any connected backend resources, facilitating potential lateral movement or persistent system compromise."
}