CVE-2025-14262CWE-708

CVE-2025-14262

Medium · published December 8, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
7.3
In the wild
Unconfirmed
What it is

A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if there were saved by the job owner. The attacker must have permissions to access the jobs but then they were saved into the catalog service using the wrong owner permissions. Therefore it may have been possible to save into spaces where the attacker does not have write permissions.

There is no workaround.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00181 · 7.3th percentile
Weakness
CWE-708 · Incorrect Ownership Assignment
Published
2025-12-08T15:16Z
Affected products (1)
ProductVersionsFixed in
knime/business_hub< 1.17.01.17.0
References (1)
https://www.knime.com/security/advisories#CVE-2025-11239 · [email protected]
EPSS history
Timeline
  • 08 DEC 09:34Z
    Jobs can be saved as workflows with wrong permissions on KNIME Business Hub
    cvelistv5