PatchTheCVECVE-2025-14262: A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save job
CVE-2025-14262 is a medium-severity flaw (CVSS 4.3) affecting business hub. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if there were saved by the job owner. The attacker must have permissions to access the jobs but then they were saved into the catalog service using the wrong owner permissions. Therefore it may have been possible to save into spaces where the attacker does not have write permissions. There is no workaround.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 92%) |
| CISA exploited list | No |
| Weakness | CWE-708 |
| Published | 2025-12-08 |
| Last modified | 2026-10-07 |
Last updated 2026-10-07 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-14262?
business hub: upgrade to 1.17.0. Exact commands for each OS are on this page.
Is CVE-2025-14262 being exploited?
CVE-2025-14262 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-14262 affect?
CVE-2025-14262 affects business hub. Severity is medium (CVSS 4.3). A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if there were saved by the job owner. The attacker must have permissions to access the jobs but then they were
How urgent is CVE-2025-14262?
Priority 17/100. No elevated risk signals yet.
Related CVEs
- CVE-2025-3019 HIGH 7.2 UPGRADE KNIME Business Hub is affected by several cross-site scripting vulnerabilities in its web pages
- CVE-2025-2787 HIGH 8.8 UPGRADE KNIME Business Hub is affected by the Ingress-nginx CVE-2025-1974 ( a.k.a IngressNightmare ) vulnerability whi
- CVE-2025-2402 HIGH 8.6 UPGRADE A hard-coded, non-random password for the object store (minio) of KNIME Business Hub in all versions except th
- CVE-2024-6598 MEDIUM 6.5 UPGRADE A denial-of-service attack is possible through the execution functionality of KNIME Business Hub 1.10.0 and 1.