CVE-2025-14262

MediumCVSS 4.3

Published: 08/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if they were saved by the job owner. The attacker must have permissions to access the jobs, but they were saved into the catalog service using the wrong owner permissions, potentially allowing saves into spaces where the attacker lacks write permissions.

Risk Assessment

An attacker could save data into spaces where they lack write permissions by impersonating the job owner, leading to integrity and access control violations. No workaround exists, increasing exploitation risk.

Recommendation

Upgrade KNIME Business Hub to version 1.17.0 or later. No workaround is available — upgrading is the only solution.

Other vulnerabilities in KNIME Business Hub

CVE-2023-3140Medium
Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME Business Hub before version 1.4.0 has left users vulnerable to clickjacking. This attack tricks users into clicking on actionable items, redirecting them to another server.

Original NVD description (English source)

A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if there were saved by the job owner. The attacker must have permissions to access the jobs but then they were saved into the catalog service using the wrong owner permissions. Therefore it may have been possible to save into spaces where the attacker does not have write permissions. There is no workaround.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS