CVE-2026-44911 is an incorrect authorization vulnerability (CWE-863) in Apache NiFi affecting versions 1.15.0 through 2.9.0. The flaw allows users with read access to submit proposed configuration properties that override existing configurations during verification requests, enabling them to invoke verification methods with altered settings. This occurs because authorization handling does not properly restrict submission of configuration verification requests to users with higher privileges. The vulnerability is mitigated in Apache NiFi 2.10.0, which enforces write access requirements for such requests.

Users with read access can submit configuration verification requests with proposed properties that override current configurations, potentially allowing unauthorized invocation of verification methods with alternative settings. This could lead to unauthorized configuration testing or information disclosure depending on the environment. However, installations that differentiate authorization levels for viewing and modifying configurations are not affected. The CVSS score is low (2.3), indicating limited impact.

Upgrade Apache NiFi to version 2.10.0 or later, which requires write access to submit configuration verification requests, effectively mitigating this vulnerability. If upgrading is not immediately possible, ensure that your NiFi installation enforces different authorization levels for viewing and modifying component configurations to prevent exploitation. Patch status is not explicitly confirmed beyond the recommendation to upgrade to 2.10.0; check the official Apache NiFi advisory for the latest remediation guidance.