KNIME Business Hub Wrong Permission Check Vulnerability Allowing Unauthorized Job Ownership Attribution

A vulnerability in KNIME Business Hub prior to version 1.17.0 allows authenticated users to save jobs from other users under the original job owner's name. This issue arises from an incorrect permission check, which enabled jobs to be saved in the catalog service with the wrong owner permissions. As a result, it may have been possible to save jobs in spaces where the user did not have write permissions. The vulnerability requires access to the jobs being manipulated.

Impact

Exploitation of this vulnerability could lead to unauthorized modification of job ownership, potentially allowing users to save jobs in restricted spaces.

Remediation

Users are advised to update to KNIME Business Hub version 1.17.0 or later.