Apache NiFi 2.11.0 supports migrating version-controlled Process Groups into Connectors via REST API methods that authorize only against the target Connector, neglecting authorization checks on the involved Process Groups. This missing authorization (CWE-862) allows an authenticated user with read access to a Connector to list identifiers, names, and flow registry details of Process Groups outside their read permissions. Additionally, users with write access to a Connector can migrate Process Groups without having write access to those groups, copying flow definitions, referenced assets, and component states, while disabling and renaming the source Process Group. Migration excludes sensitive property values and requires the source Process Group to be stopped with empty queues, limiting exposure. Installations lacking component-level Process Group authorization policies are not vulnerable because Connector write permissions act as the security boundary. The vulnerability is addressed in Apache NiFi 2.12.0 by filtering migration sources to only authorized Process Groups and requiring write access to the source Process Group for migration requests.

The vulnerability allows unauthorized enumeration of version-controlled Process Groups and unauthorized migration of Process Groups by users with write access to Connectors but without write access to those Process Groups. This could lead to unauthorized disclosure of Process Group metadata and unauthorized copying and disabling of Process Groups. However, sensitive properties are excluded from migration, and the source Process Group must be stopped with empty queues, which limits the scope of potential impact. Installations without component-level Process Group authorization policies are not affected.

Upgrade to Apache NiFi version 2.12.0 or later, which enforces authorization checks on Process Groups during migration by filtering migration sources to only those Process Groups the user is authorized to read and requiring write access to the source Process Group when submitting migration requests. If upgrading is not immediately possible, ensure that component-level authorization policies for Process Groups are implemented to prevent unauthorized migration. No other mitigations are specified.