CVE-2026-44914

Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include extension components with specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates additional privileges required, but framework authorization did not check restricted status when handling requests to replace Process Groups. The missing authorization permits a user with general write access to add components with Restricted status. Apache NiFi installations that do not implement specific authorization for Restricted components are not subject to this vulnerability because the framework enforces write permissions as the security boundary. Upgrading to Apache NiFi 2.9.0 is the recommended mitigation, which removes the implementation of Restricted status authorization from the framework.

• CWE-862

• https://lists.apache.org/thread/ydr34t03xd1n0t9oogpzogjrd5y93838Mailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2026/06/20/6Mailing List, Third Party Advisory

Published

Jun 22, 2026

Last Modified

Jun 24, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44905Vanetza is an open-source implementation of the ETSI C-ITS p…7.5
• CVE-2026-44907A denial of service vulnerability could be triggered by send…7.5
• CVE-2026-44909Proxygen lacked a generalized slow-consumer detection mechan…7.5
• CVE-2026-4491A vulnerability has been found in Tenda A18 Pro 02.03.02.28.…8.8
• CVE-2026-44911Authorization handling for component configuration verificat…6.3
• CVE-2026-44913Improper escaping of database table names in the CaptureChan…7.2
• CVE-2026-44915URL Redirection to Untrusted Site ('Open Redirect') vulnerab…6.1
• CVE-2026-44916In OpenStack Ironic before 35.0.2 (in a certain non-default …3
• CVE-2026-44917OpenStack Ironic before 35.0.2 allows a malicious authentica…4.9
• CVE-2026-44918OpenStack Ironic through before 37.0.1 allows creation or mo…5.5
• CVE-2026-44919In OpenStack Ironic through 35.x before a3f6d73, during imag…6.5
• CVE-2026-4492A vulnerability was found in Tenda A18 Pro 02.03.02.28. The …8.8