CVE-2026-77226 in Camunda Allows Unauthorized Admin Account Creation
ID: f827cc35-653c-5c19-a2fe-67fe5e6990fa
STIX ID: report--f827cc35-653c-5c19-a2fe-67fe5e6990fa
Feed Name: ThreatCluster
Threat Score
Camunda 7.24.0 through 7.24.14 contain a critical authorization flaw (CVE-2026-77226) in the Admin web app's first-run setup endpoint that permits unauthenticated attackers to create administrator accounts when the camunda-admin group is empty; internet-facing Admin deployments are at risk. A patch was released on 2026-10-05; organizations are advised to apply the update immediately, restrict access to the setup endpoint, and verify admin accounts until patched.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.