Camunda Engine versions prior to 7.24.14 (including 7.24.0) and prior to 7.23.17 contain a missing authorization check within the REST task sub‑resources for attachments and comments. The singular read and delete endpoints in TaskAttachmentResourceImpl and TaskCommentResourceImpl lack the authorization filters that are present on the corresponding list endpoints, enabling authenticated users who otherwise lack permission to retrieve, download, or permanently delete task attachments and comments. This weakness results in the disclosure of potentially sensitive data and allows an attacker to erase important historical records, compromising both confidentiality and integrity. The vulnerability is a classic example of missing authorization (CWE‑639) and improper access control (CWE‑862), with the attacker capable of reading or deleting arbitrary task attachment data by simply knowing the resource identifier.

The affected products are Camunda BPM Engine 7, specifically version 7.24.0 running up to but excluding 7.24.14 and version 7.23.0 up to but excluding 7.23.17. Any installation of Camunda 7 within these version ranges that exposes the engine‑rest API is vulnerable. The issue is tied to the task attachment and comment endpoints.

The CVSS score of 8.6 classifies this flaw as high severity, indicating a significant impact if exploited. The EPSS score is not available, and the flaw is not currently listed in the CISA KEV catalog, implying that while there is no public blame or exploited instance known, the vulnerability still poses substantial risk. Attackers must be authenticated, but they do not need elevated privileges or possession of specific permission grants. They simply need to target valid resource identifiers, making the attack straightforward for users who can obtain those IDs from other endpoints or through trial and error. The likely attack vector is the REST API: an authenticated client can request or submit HTTP requests to /task/{taskId}/attachment/{attachmentId} or /task/{taskId}/comment/{commentId} and bypass normal authorization checks, enabling data exfiltration or deletion.