CVE-2026-25903 json
Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates
published 2026-02-17 8 mo ago modified 2026-09-08 2 mo ago also BIT-nifi-2026-25903 , EUVD-2026-7819 , GHSA-c5w7-m8wf-xc77
- cvss
- 6.6
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 55%
- public exploits
- 0
- none known
Summary
Apache NiFi 1.1.0 through 2.7.2 are missing authorization when updating configuration properties on extension components that have specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates additional privileges required to add the annotated component to the flow configuration, but framework authorization did not check restricted status when updating a component previously added. The missing authorization requires a more privileged user to add a restricted component to the flow configuration, but permits a less privileged user to make property configuration changes. Apache NiFi installations that do not implement different levels of authorization for Restricted components are not subject to this vulnerability because the framework enforces write permissions as the security boundary. Upgrading to Apache NiFi 2.8.0 is the recommended mitigation.
Patch / fix
- maven org.apache.nifi:nifi-web-api 2.8.0
- bitnami nifi 2.8.0
- Apache Software Foundation Apache NiFi 2.8.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 8 mo ago
Exploit prediction
0.75% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:Y/R:I/V:C/RE:M/U:Amber |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:I/V:C/RE:M/U:Amber |
| NVD | 3.1 | 6.6 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.nifi:nifi-web-api | >=1.1.0, <2.8.0 |
2.8.0 |
| bitnami | nifi | >=1.1.0, <2.8.0 |
2.8.0 |
Affected products
- Apache Software Foundation Apache NiFi
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/apache/nifi/commit/119f8881fbc3cbd0d522b0c549b841da3de01f64
web
-
lists.apache.org
/thread/jf6bkt9sk6xvshy8xyxv3vtlxd340345
vendor-advisory, web, mailing-list, advisory
-
openwall.com
/lists/oss-security/2026/02/16/1
web, mailing-list, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-25903
advisory, web
-
github.com
/apache/nifi
package
-
issues.apache.org
/jira/browse/NIFI-15567
web
Sources
- CVE List CVE-2026-25903
- GitHub Advisory GHSA-c5w7-m8wf-xc77
- NVD CVE-2026-25903
- OSV BIT-nifi-2026-25903
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.