Apache NiFi 1.5.0 through 2.11.0 provide REST API methods for replacing Process Group contents using client-supplied flow definitions. These methods only check read and write privileges on the Process Group itself, unlike asynchronous update methods that also authorize nested components such as Controller Services and Parameter Contexts. This missing authorization allows an authenticated user with write access to a Process Group to modify or remove components in descendant Process Groups protected by stricter policies and bind components to Controller Services and Parameter Contexts without authorization. The vulnerability is limited by existing verification checks to stopped components and only affects deployments using component-level authorization policies. The recommended mitigation is upgrading to Apache NiFi 2.12.0, which applies consistent authorization across these methods.

An authenticated user with write access to a Process Group can bypass component-level authorization controls to modify or remove components in descendant Process Groups with more restrictive policies. This could lead to unauthorized changes in the flow configuration, potentially impacting the integrity of data flows. However, the impact is limited to stopped components and deployments using component-level authorization policies. There are no known exploits in the wild.

Upgrade Apache NiFi to version 2.12.0 or later, which implements consistent authorization checks for Process Group replacement and versioned flow update methods. This upgrade enforces proper authorization on all referenced components, mitigating the vulnerability. No other mitigation is indicated by the vendor advisory.