CVE-2026-115502

EUVD-2026-108229
A missing authorization check allows anyone having access to a "link without login" for a DataApp to list and potentially access jobs of other users created by the same link in KNIME Business Hub prior to 1.19.0. As workaround remove all "links without login" to DataApps.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
KNIMECNA
6.3 MEDIUM
NETWORK
HIGH
NONE
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 19.1%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
knimebusiness_hub
𝑥
< 1.19.0
CNA
Common Weakness Enumeration
References
https://www.knime.com/security/advisories