Apache NiFi 2.0.0 through 2.10.0 allow creating, reading, and deleting Assets linked to Parameter Contexts via the REST API. The authorization check for asset deletion only verifies the supplied Parameter Context Identifier but does not confirm that the Asset Identifier belongs to that Parameter Context. This incorrect authorization (CWE-863) can allow users with write permissions on one Parameter Context to delete assets from another if authorization boundaries are not properly segregated. The vulnerability is mitigated in Apache NiFi 2.11.0, which adds verification of Parameter Context ownership of the Asset before allowing deletion, using the same approach as for asset read operations.

The vulnerability allows users with write permissions on a Parameter Context to potentially delete assets associated with other Parameter Contexts if different authorization levels are not enforced across contexts. This could lead to unauthorized asset deletion, impacting data integrity and operational stability. However, installations that implement distinct authorization boundaries per Parameter Context are not affected. The CVSS 4.0 base score is low (2.3), reflecting limited impact and attack complexity.

Upgrade Apache NiFi to version 2.11.0 or later, where the vulnerability is fixed by verifying Parameter Context ownership of the requested Asset before deletion. No other official remediation or temporary fixes are documented. Since this is a software vulnerability in on-premises deployments, users must apply the update manually. Installations that already enforce strict authorization boundaries per Parameter Context are not vulnerable.