Apache NiFi Authorization Bypass in Restricted Component Updates (CVE-2026-25903)

Apache NiFi disclosed a high-severity authorization flaw, tracked as CVE-2026-25903, that allows a lower-privileged user to modify configuration properties of Restricted extension components after they have been added to a flow by a more privileged user. The issue affects NiFi versions 1.1.0 through 2.7.2 and stems from missing authorization checks during component property updates: the framework enforced the extra privileges required to add a Restricted component, but did not consistently re-check the component’s restricted status when updating it, enabling an authorization bypass (CWE-862). Potential impact includes tampering with dataflow logic and, depending on the component and environment, enabling unsafe actions such as triggering sensitive operations or altering processing behavior.

Risk is conditional on deployments that implement distinct authorization levels for Restricted components; installations that do not differentiate authorization levels are described as not subject to this specific bypass because standard write permissions remain the effective security boundary. Upgrading to NiFi 2.8.0 is the recommended mitigation, and the issue was reported via responsible disclosure (credited to David Handermann in reporting). CVE records also reference public advisories and include a CVSS v4.0 vector indicating network reachability and high potential impact, while noting prerequisites such as the need for a privileged user to have already introduced the Restricted component into the flow.