Missing Authorization Check in KNIME Business Hub
CVE-2026-115502

6.3MEDIUM

Key Information:

Vendor

Knime

Status
Knime Business Hub
Vendor
CVE Published:
22 October 2026

What is CVE-2026-115502?

A missing authorization check in KNIME Business Hub allows users with access to a 'link without login' for a DataApp to enumerate and potentially access jobs created by other users associated with that link. This vulnerability affects versions prior to 1.19.0. It is recommended to remove all 'links without login' to DataApps as a mitigative measure.

Affected Version(s)

KNIME Business Hub 0 < 1.19.0

KNIME Business Hub 1.19.0

References

https://www.knime.com/security/advisories

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rock Jein
.