CVE-2025-14262: Jobs can be saved as workflows with wrong permissions on KNIME Business Hub
A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if there were saved by the job owner. The attacker must have permissions to access the jobs but then they were saved into the catalog service using the wrong owner permissions. Therefore it may have been possible to save into spaces where the attacker does not have write permissions.
There is no workaround.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
KNIME Business Hubto a version that resolves this vulnerability.Fixed in 1.17.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14262?
CVE-2025-14262 is considered a moderate severity vulnerability due to its potential for unauthorized job access.
How do I fix CVE-2025-14262?
To fix CVE-2025-14262, upgrade to KNIME Business Hub version 1.17.0 or later.
What type of vulnerability is CVE-2025-14262?
CVE-2025-14262 is a permission-check vulnerability affecting job management in KNIME Business Hub.
Who is affected by CVE-2025-14262?
Authenticated users of KNIME Business Hub prior to version 1.17.0 are affected by CVE-2025-14262.
What is the impact of CVE-2025-14262?
CVE-2025-14262 allows unauthorized users to save jobs of other users, leading to potential data exposure.