Apache NiFi versions 2.0.0 through 2.10.0 allow creating, reading, and deleting Assets tied to Parameter Contexts via the REST API. The authorization check for asset deletion relies solely on the supplied Parameter Context Identifier and does not verify that the Asset Identifier belongs to that Parameter Context. This incorrect authorization (CWE-863) can be exploited in environments where different authorization levels exist across Parameter Contexts, potentially allowing unauthorized asset deletions. The vulnerability is mitigated in Apache NiFi 2.11.0, which adds verification of Parameter Context ownership of the Asset before allowing deletion, aligning deletion checks with those used for asset reads.

The vulnerability allows an attacker with limited privileges (low CVSS score 2.3) to delete assets associated with Parameter Contexts they should not have access to, but only in deployments where different authorization levels are implemented across Parameter Contexts. If no such differentiation exists, the vulnerability does not apply. The impact is limited to unauthorized deletion of assets, with no indication of further privilege escalation or data disclosure.

Upgrading Apache NiFi to version 2.11.0 or later is the recommended mitigation, as this version includes a fix that verifies Parameter Context ownership of the requested Asset before deletion. No official patch or temporary fix is indicated beyond upgrading. Since this is not a cloud service, remediation depends on user upgrade. Users should review their authorization configurations to understand exposure and apply the upgrade accordingly.