CVE-2026-62354 is an incorrect authorization vulnerability (CWE-863) in Apache NiFi affecting versions 1.10.0 through 2.10.0. The flaw allows users with read access to submit proposed Parameter Context validation requests that override existing configurations, effectively enabling unauthorized invocation of component validation methods with alternative parameters. This occurs because the authorization handling does not properly restrict submission of proposed values to users with write permissions. The vulnerability is mitigated in Apache NiFi 2.11.0, which enforces write access for these requests.

An attacker with read access can submit altered Parameter Context validation requests that override current configurations, potentially causing unintended component validation behavior. This could lead to unauthorized changes in system behavior or validation outcomes. The impact is limited to environments where authorization for viewing and modifying Parameter Context configurations is not properly separated.

Upgrade Apache NiFi to version 2.11.0 or later, where the vulnerability is fixed by requiring write access to submit Parameter Context validation requests. If upgrading is not immediately possible, ensure that authorization policies enforce different levels of access for viewing and modifying Parameter Context configurations to prevent exploitation.