Camunda Engine versions before 7.24.14 and 7.23.17 contain an authorization bypass in the Cockpit web application that lets authenticated users override permission checks via an inverted comparison in AbstractCockpitPluginResource.isPermissionDisabled(). When a non‑empty disabledPermissions configuration exists, attackers with minimal Cockpit rights can read all process instances, definitions, and incidents across the entire engine without any audit logging. This flaw enables full data disclosure to users who are not actually granted such visibility.

The vulnerability applies to Camunda 7.24.0 prior to 7.24.14 and Camunda 7.23.0 prior to 7.23.17, both components of the Camunda BPM Engine under the Camunda 7 product line.

The CVSS score of 6 indicates medium severity, and the EPSS score is not available; the flaw is not cataloged in CISA KEV. Exploit requires an authenticated user, so the likely attack vector involves an internal threat or compromised user account. While the exploit does not grant code execution, it enables unrestricted data exposure system‑wide, which can aid further attacks if the disclosed information is leveraged.