CVE-2026-82561

Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow definition, covering Process Group flow replacement together with versioned flow update and rebase operations. Framework authorization for these methods was limited to read and write privileges on the Process Group itself, unlike the corresponding asynchronous update request methods, which also authorize the components encapsulated in the Process Group along with referenced Controller Services, Parameter Contexts, and Parameter Providers. As a result of the missing authorization, an authenticated user with write access to a Process Group could supply a flow definition that modifies or removes components in descendant Process Groups protected by more restrictive access policies, and could bind components to Controller Services and Parameter Contexts without authorization for those referenced components. Existing verification checks limited the impact to stopped components, and the issue applies only to deployments that use component-level authorization policies, because the framework enforces write permissions as the security boundary. Upgrading to Apache NiFi 2.12.0 is the recommended mitigation, which applies consistent reference resolution and component authorization across Process Group replacement and versioned flow update methods

• CWE-862

• https://lists.apache.org/thread/opk7l8wqvnl85qxlzj3dnxp6qbk27lwmMailing List, Vendor Advisory
• https://www.openwall.com/lists/oss-security/2026/09/16/9Mailing List, Third Party Advisory

Published

Sep 16, 2026

Last Modified

Sep 21, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-82553A vulnerability was detected in sambitraj Student Management…6.3
• CVE-2026-82554A flaw has been found in SourceCodester Queue Management Sys…4.3
• CVE-2026-82555A vulnerability has been found in TOTOLINK N600R 4.3.0cu.786…3.7
• CVE-2026-82556A vulnerability was found in Forgejo up to 15.0.4. This issu…6.3
• CVE-2026-8256A security vulnerability has been detected in Devs Palace ER…2.4
• CVE-2026-82560Pod::Text versions before 6.1.1 for Perl allow CPU and memor…7.5
• CVE-2026-82562### Summary When `qs.parse` is called with `comma: true` …3.7
• CVE-2026-82563An attacker could impersonate the camera and place themselve…7.6
• CVE-2026-82564Authorization Bypass Through User-Controlled Key vulnerabili…7.1
• CVE-2026-82566The Botslab G980H dash camera firmware contains a session ma…8.8
• CVE-2026-82567The myPRO Manager notification gateway exposes an unauthenti…6.3
• CVE-2026-8257A vulnerability was detected in WebAssembly Binaryen up to 1…5.5