CVE-2025-14262 - CVE House
Back to Database
Status published Medium CVE-2025-14262

Jobs can be saved as workflows with wrong permissions on KNIME Business Hub

Vulnerability Description

A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if there were saved by the job owner. The attacker must have permissions to access the jobs but then they were saved into the catalog service using the wrong owner permissions. Therefore it may have been possible to save into spaces where the attacker does not have write permissions. There is no workaround.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-14262

Credits & Attribution

No credits recorded in the NVD database.

References

More from KNIME

View All →
CVE-2025-3019
Cross-site scripting vulnerabilities in KNIME Business Hub web pages
Medium 5.3
CVE-2025-2787
Ingress-nginx vulnerability in KNIME Business Hub
High 8.7
CVE-2025-2402
Hard-coded password for object store of KNIME Business Hub
High 8.8
CVE-2025-11240
Open redirect vulnerability in KNIME Business Hub
Medium 5.3
CVE-2025-11239
Job details are visible to all team members on KNIME Business Hub
Low 2.3

Affected Vendor

Affected Software

KNIME Business Hub
Vulnerable Versions:
0, 1.17.0

Timeline

Official Publish: December 8th, 2025
Last Modified: December 8th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-708

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.