CVE-2025-11239 - CVE House
Back to Database
Status published Low CVE-2025-11239

Job details are visible to all team members on KNIME Business Hub

Vulnerability Description

Potentially sensitive information in jobs on KNIME Business Hub prior to 1.16.0 were visible to all members of the user's team. Starting with KNIME Business Hub 1.16.0 only metadata of jobs is shown to team members. Only the creator of a job can see all information including in- and output data (if present).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-11239

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Zigrin

References

More from KNIME

View All →
CVE-2025-3019
Cross-site scripting vulnerabilities in KNIME Business Hub web pages
Medium 5.3
CVE-2025-2787
Ingress-nginx vulnerability in KNIME Business Hub
High 8.7
CVE-2025-2402
Hard-coded password for object store of KNIME Business Hub
High 8.8
CVE-2025-14262
Jobs can be saved as workflows with wrong permissions on KNIME Business Hub
Medium 5.3
CVE-2025-11240
Open redirect vulnerability in KNIME Business Hub
Medium 5.3

Affected Vendor

Affected Software

KNIME Business Hub
Vulnerable Versions:
0, 1.16.0

Timeline

Official Publish: October 2nd, 2025
Last Modified: October 2nd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-863

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1021 Remote Services
Lateral Movement
T1098 Account Manipulation
Defense Evasion