critical
CVE-2026-77226
Camunda Platform 7.24.0 before 7.24.15: the Admin web application's first-run setup endpoint stays reachable after setup has already been completed, so an unauthenticated caller can create an administrator account
- Severity
- critical
- Affected product
- Camunda Platform 7
- Affected versions
- Camunda Platform 7 ≥ 7.24.0, < 7.24.15
- Fixed in
- Camunda Platform 7 7.24.15
- Detection basis
- Component version range
- Shipped rule
- Camunda Platform 7: Camunda Platform 7.24.0 before 7.24.15: the Admin web application's first-run setup endpoint stays reachable after setup has already been completed, so an unauthenticated caller can create an administrator account
- Added to NewScan
- 2026-10-06
- Detected by
- NewScan — free, self-hosted
How NewScan reports it
COMPONENT VERSION RANGE
NewScan fingerprints Camunda Platform 7 from its response and reports this CVE when the detected version falls inside the affected range below.
References
Scan for this yourself — local, in-band scanning is free.
Get NewScan (FREE) →Review the measured benchmark, then use the verified remediation process.