CVE-2025-14262

A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if there were saved by the job owner. The attacker must have permissions to access the jobs but then they were saved into the catalog service using the wrong owner permissions. Therefore it may have been possible to save into spaces where the attacker does not have write permissions. There is no workaround.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.knime.com/security/advisories#CVE-2025-11239	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:knime:business_hub:*:*:*:*:*:*:*:*

History

07 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Una comprobación de permisos errónea en KNIME Business Hub antes de la versión 1.17.0 permitió a un usuario autenticado guardar trabajos de otros usuarios como si hubieran sido guardados por el propietario del trabajo. El atacante debe tener permisos para acceder a los trabajos, pero luego estos se guardaron en el servicio de catálogo utilizando permisos de propietario erróneos. Por lo tanto, pudo haber sido posible guardar en espacios donde el atacante no tiene permisos de escritura. No hay solución alternativa.

Information

Published : 2025-12-08 10:16

Updated : 2026-10-07 20:10

NVD link : CVE-2025-14262

Mitre link : CVE-2025-14262

CVE.ORG link : CVE-2025-14262

JSON object : View

Products Affected

knime

business_hub

CWE

CWE-708

Incorrect Ownership Assignment

{"id": "CVE-2025-14262", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14262", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-08T17:19:22.717267Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security@knime.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 5.3, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Green", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "GREEN", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "MODERATE", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@knime.com", "affectedData": [{"vendor": "KNIME", "modules": ["execution and catalog functionality"], "product": "KNIME Business Hub", "versions": [{"status": "affected", "version": "0", "lessThan": "1.17.0", "versionType": "semver"}, {"status": "unaffected", "version": "1.17.0", "versionType": "semver"}], "defaultStatus": "affected"}]}], "published": "2025-12-08T10:16:01.047", "references": [{"url": "https://www.knime.com/security/advisories#CVE-2025-11239", "tags": ["Vendor Advisory"], "source": "security@knime.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@knime.com", "description": [{"lang": "en", "value": "CWE-708"}]}], "descriptions": [{"lang": "en", "value": "A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if there were saved by the job owner. The attacker must have permissions to access the jobs but then they were saved into the catalog service using the wrong owner permissions. Therefore it may have been possible to save into spaces where the attacker does not have write permissions.\n\nThere is no workaround."}, {"lang": "es", "value": "Una comprobaci\u00f3n de permisos err\u00f3nea en KNIME Business Hub antes de la versi\u00f3n 1.17.0 permiti\u00f3 a un usuario autenticado guardar trabajos de otros usuarios como si hubieran sido guardados por el propietario del trabajo. El atacante debe tener permisos para acceder a los trabajos, pero luego estos se guardaron en el servicio de cat\u00e1logo utilizando permisos de propietario err\u00f3neos. Por lo tanto, pudo haber sido posible guardar en espacios donde el atacante no tiene permisos de escritura.\n\nNo hay soluci\u00f3n alternativa."}], "lastModified": "2026-10-07T20:10:01.970", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:knime:business_hub:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D16AA853-3F50-4B2F-BFB1-59EE07944BBB", "versionEndExcluding": "1.17.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@knime.com"}