A missing authorization check in KNIME Business Hub allows users who possess a public “link without login” for a DataApp to view the list of jobs created by other users and potentially access those jobs. This flaw, rooted in an access control weakness (CWE‑862), can lead to the unintended disclosure of job details and other sensitive configuration information, compromising confidentiality for unintended parties.

Affected systems are KNIME Business Hub deployments running any version prior to 1.19.0. All KNIME Business Hub instances that allow creation of public links for DataApps are vulnerable when the older software version is in use.

The CVSS score of 6.3 indicates a moderate severity vulnerability with a medium impact on confidentiality. Because the flaw can be exploited simply by sharing or clicking an unauthenticated link, the risk is elevated for users who publish links without login. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. An attacker does not require privileged credentials; the presence of an unauthenticated link provides the necessary attack vector, making the vulnerability exploitable from a remote, non‑authenticated position.