CVE-2026-77226

Summary

The flaw allows an unauthenticated attacker to create a new administrator account by exploiting an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint.

Exploitability

Exploitation is relatively straightforward if the camunda-admin group is empty but the system is fully administered. Precondition is the absence of direct members in the camunda-admin group.

Blast radius

If exploited, this could result in account takeover and potential process deployment or script execution as the engine's service user, leading to significant system compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Camunda 7.24.15 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.