Medium severity · published Oct 2, 2025
CVE-2025-11239
Job details are visible to all team members on KNIME Business Hub
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
Potentially sensitive information in jobs on KNIME Business Hub prior to 1.16.0 were visible to all members of the user's team. Starting with KNIME Business Hub 1.16.0 only metadata of jobs is shown to team members. Only the creator of a job can see all information including in- and output data (if present).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KB
KNIME Business Hub · KNIME
before 1.16.0 · source: vendor
BH
Business Hub · Knime
before 1.16.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-11239
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-11239
Vendor Advisory
https://www.knime.com/security/advisories
More from KNIME Business Hub
8.8
CVE-2025-2787
Ingress-nginx vulnerability in KNIME Business Hub
8.6
CVE-2025-2402
Hard-coded password for object store of KNIME Business Hub
7.2
CVE-2025-11240
Open redirect vulnerability in KNIME Business Hub
7.2
CVE-2025-3019
Cross-site scripting vulnerabilities in KNIME Business Hub web pages
6.9
CVE-2026-115496
Workflow names may be leaked to unauthenticated users in KNIME Business Hub