Vulnerability · Published Oct 2, 2025 · Assigned by KNIME
CVE-2025-11239Job details are visible to all team members on KNIME Business Hub
Low 2.3
In plain English
A low-severity incorrect authorization in KNIME Business Hub from KNIME. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).
Severity (CVSS 4.0)2.3Low
Exploit odds (30 days)0.2%top 88.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Potentially sensitive information in jobs on KNIME Business Hub prior to 1.16.0 were visible to all members of the user's team. Starting with KNIME Business Hub 1.16.0 only metadata of jobs is shown to team members. Only the creator of a job can see all information including in- and output data (if present).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| KNIME | KNIME Business Hub | 0 – before 1.16.0 |
Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/U:Green