Overly informative error messages in the catalog functionality of KNIME Business Hub prior to version 1.18.5 allow an authenticated remote attacker who knows a workflow ID to retrieve the corresponding workflow name, thereby revealing potentially sensitive project information. The vulnerability is an information‑disclosure flaw, classified as CWE‑209, and can be used to construct a map of available workflows within the organization.

The affected product is KNIME Business Hub with versions older than 1.18.5 from the KNIME organization. Any instance of the Business Hub running these versions and exposing the catalog API to network traffic is potentially vulnerable.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. The attack vector is remote and requires authentication, meaning only users with valid credentials to the Business Hub can trigger the information disclosure. Given that the flaw is solely informational, the primary risk is to confidentiality of project metadata.