Medium severity · published Dec 8, 2025
CVE-2025-14262
Jobs can be saved as workflows with wrong permissions on KNIME Business Hub
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if there were saved by the job owner. The attacker must have permissions to access the jobs but then they were saved into the catalog service using the wrong owner permissions. Therefore it may have been possible to save into spaces where the attacker does not have write permissions.
There is no workaround.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KB
KNIME Business Hub · KNIME
before 1.17.0 · source: vendor
BH
Business Hub · Knime
before 1.17.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-14262
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-14262
Vendor Advisory
https://www.knime.com/security/advisories#CVE-2025-11239
More from KNIME Business Hub
8.8
CVE-2025-2787
Ingress-nginx vulnerability in KNIME Business Hub
8.6
CVE-2025-2402
Hard-coded password for object store of KNIME Business Hub
7.2
CVE-2025-11240
Open redirect vulnerability in KNIME Business Hub
7.2
CVE-2025-3019
Cross-site scripting vulnerabilities in KNIME Business Hub web pages
6.9
CVE-2026-115496
Workflow names may be leaked to unauthenticated users in KNIME Business Hub