Apache NiFi versions 1.10.0 through 2.0.0 lack complete authorization verification when creating new Process Groups that bind to Parameter Contexts or reference Controller Services and Parameter Providers. Specifically, if a Process Group does not reference any Parameter values, the framework fails to check user authorization for the bound Parameter Context, allowing clients to download non-sensitive Parameter values. Additionally, authorization checks are missing for referenced Controller Services and Parameter Providers, enabling unauthorized use of these components. This vulnerability affects only authenticated users authorized to create Process Groups and deployments with component-based authorization policies. The issue is fixed in Apache NiFi 2.1.0, which includes proper authorization checks for these references during Process Group creation.

Authenticated users with permission to create Process Groups can bypass fine-grained authorization controls on Parameter Contexts, Controller Services, and Parameter Providers. This allows them to download non-sensitive Parameter values and use Controller Services or Parameter Providers they are otherwise unauthorized to access. The impact is limited in scope to users with Process Group creation rights and deployments using component-based authorization policies. No known exploits are reported in the wild.

Upgrade Apache NiFi to version 2.1.0 or later, which includes fixes to enforce authorization checks for Parameter Contexts, Controller Services, and Parameter Providers during Process Group creation. This is the recommended and official remediation. No additional mitigations are indicated by the vendor advisory.