In Bonitasoft runtime Community edition, the lack of dynamic permissions causes IDOR vulnerability. Dynamic permissions existed only in Subscription edition and have now been restored in Community edition, where they are not custmizable.

Last Modified: Apr 15, 2026

Published: May 15, 2024

CVE-2024-26542

Cross Site Scripting vulnerability in Bonitasoft, S.A v.7.14. and fixed in v.9.0.2, 8.0.3, 7.15.7, 7.14.8 allows attackers to execute arbitrary code via a crafted payload to the Groups Display name field.

Last Modified: Sep 17, 2025

Published: Feb 27, 2024

CVE-2020-36640

bonitasoft bonita-connector-webservice SecureWSConnector.java TransformerConfigurationException xml external entity reference

Last Modified: Apr 10, 2025

Published: Jan 05, 2023

CVE-2022-25237

Bonita Web 2021.2 is affected by a authentication/authorization bypass vulnerability due to an overly broad exclude pattern used in the RestAPIAuthorizationFilter. By appending ;i18ntranslation or /../i18ntranslation/ to the end of a URL, users with no privileges can access privileged API endpoints. This can lead to remote code execution by abusing the privileged API actions.

Last Modified: Nov 21, 2024

Published: May 27, 2022

CVE-2015-3898

Multiple open redirect vulnerabilities in Bonita BPM Portal before 6.5.3 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the redirectUrl parameter to (1) bonita/login.jsp or (2) bonita/loginservice.

Last Modified: Nov 21, 2024

Published: Feb 28, 2018

Items Per Page