CVE-2026-91145 Overview
CVE-2026-91145 is an expression injection vulnerability in Activiti through version 7.1.0.M6. The ExpressionResolver component fails to validate hash-brace deferred expressions (#{...}) stored in process variables. Attackers with permission to submit process variables can inject expressions that bypass Activiti's expression filtering. When a mail task later renders a variable-backed body field, the expression is evaluated in the full Spring context. This enables method invocation on application beans and leads to unauthorized data access or code execution paths through the workflow engine.
Critical Impact
Authenticated attackers can inject Spring expressions that execute against application beans, exposing sensitive data and enabling further exploitation of the Activiti workflow engine.
Affected Products
- Activiti Core through 7.1.0.M6
- Activiti Engine MailActivityBehavior component
- Activiti API Process Runtime ExpressionResolver component
Discovery Timeline
- 2026-09-14 - CVE-2026-91145 published to NVD
- 2026-09-15 - Last updated in NVD database
Technical Details for CVE-2026-91145
Vulnerability Analysis
Activiti implements filtering to prevent expression injection in process variables. The filter targets standard ${...} Spring expression syntax that would be evaluated by the JUEL engine. The deferred-expression form #{...} is not covered by this filter, allowing attackers to smuggle expressions past the sanitization layer.
The injected expression persists in the process variable store. When a subsequent mail task references that variable in its to, from, subject, html, or text body fields, the mail activity resolves the value through the full Spring expression context. At this point the previously stored #{...} payload is evaluated with access to Spring-managed beans.
This flaw is classified as [CWE-917] Improper Neutralization of Special Elements used in an Expression Language Statement. Exploitation requires only low privileges on the network-accessible workflow API.
Root Cause
The ExpressionResolver in activiti-api-process-runtime-impl inspects string values for expression delimiters before persisting them as process variables. Its validation logic recognizes only the immediate ${ prefix and does not treat #{ as a dangerous construct. As a result, deferred expressions traverse the sanitization boundary untouched and are later re-evaluated by MailActivityBehavior when it expands variable references into email fields.
Attack Vector
An authenticated user submits a process variable value containing a payload of the form #{beanName.method(args)}. The process then advances to a service task of type mail where a body field is populated from that variable. Activiti's MailActivityBehavior performs a second expression resolution against the Spring ApplicationContext, invoking the referenced bean method. The attack requires network access to the Activiti API and low privileges to start or interact with a process instance.
No verified public exploit code is available. Refer to the VulnCheck Activiti Advisory and the Activiti ExpressionResolver Source Code for the technical details of the filter gap.
Detection Methods for CVE-2026-91145
Indicators of Compromise
- Process variable values containing the #{ deferred-expression prefix, particularly in string fields consumed by mail tasks.
- Unexpected outbound SMTP activity or mail task failures logged by MailActivityBehavior.
- Spring bean method invocations originating from the Activiti engine thread that do not correspond to legitimate workflow logic.
Detection Strategies
- Inspect the Activiti variable store (ACT_RU_VARIABLE, ACT_HI_VARINST) for values matching the regex #\{[^}]+\}.
- Enable verbose logging on org.activiti.engine.impl.bpmn.behavior.MailActivityBehavior and correlate rendered mail fields with source variables.
- Alert on process definitions where mail task body fields reference variables that are user-supplied.
Monitoring Recommendations
- Monitor Activiti REST and Java API endpoints that create or update process variables for payloads containing #{.
- Review application logs for Spring EL evaluation errors, which may indicate failed injection attempts.
- Track access to sensitive Spring beans invoked from BPMN execution threads and baseline expected callers.
How to Mitigate CVE-2026-91145
Immediate Actions Required
- Restrict who can create or modify process variables in Activiti to trusted, authenticated identities only.
- Audit deployed BPMN definitions and remove or refactor mail tasks whose body fields consume unvalidated user-supplied variables.
- Apply input validation at the application layer to reject variable values containing #{ or ${ sequences.
Patch Information
No vendor patch is referenced in the NVD record at the time of publication. Track the Activiti Issue #5438 and the Activiti GitHub Repository for remediation updates. Upgrade beyond 7.1.0.M6 once a fixed release becomes available.
Workarounds
- Implement a request filter or interceptor that rejects process variable payloads containing deferred-expression delimiters (#{).
- Replace variable-backed mail body fields with static templates or server-side rendered content that does not pass through Spring EL evaluation.
- Reduce the Spring ApplicationContext exposed to the Activiti expression evaluator so that sensitive beans are not reachable.
# Example ingress filter concept for Activiti REST API
# Reject any process variable payload containing deferred expressions
grep -E '"value"\s*:\s*"[^"]*#\{' request_body.json && \
echo "BLOCKED: deferred expression detected" && exit 1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.