CVE-2025-11239CWE-863broken-access-control

CVE-2025-11239

Medium · published October 2, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
10.8
In the wild
Unconfirmed
What it is

Potentially sensitive information in jobs on KNIME Business Hub prior to 1.16.0 were visible to all members of the user's team. Starting with KNIME Business Hub 1.16.0 only metadata of jobs is shown to team members. Only the creator of a job can see all information including in- and output data (if present).

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00211 · 10.8th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2025-10-02T17:15Z
Affected products (1)
ProductVersionsFixed in
knime/business_hub< 1.16.01.16.0
References (1)
https://www.knime.com/security/advisories · [email protected]
EPSS history
Timeline
  • 02 OCT 12:23Z
    Job details are visible to all team members on KNIME Business Hub
    cvelistv5