Back to feed
EUVD-2026-108229 · Published Oct 22, 2026 · 3d ago
A missing authorization check allows anyone having access to a "link without login" for a DataApp to list and potentially access jobs of other users created by the same link in KNIME Business Hub prior to 1.19.0. As workaround remove all "links without login" to DataApps.
Weaknesses
CWE-862
CVSS scores
- v4.06.3
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access Persistence Stealth Defense Impairment Credential Access
References
Potentially impacted assets
See if this affects your attack surface
