The flaw is a missing authorization check when updating configuration properties on components that carry a Restricted annotation. Attackers with a lower privilege level, once a restricted component exists in the flow, can change those properties without the higher privileges required to add the component. This can allow the attacker to alter behavior, inject malicious logic, or bypass security controls, effectively raising their privilege level. The weakness is identified as CWE‑862.

Apache NiFi versions 1.1.0 through 2.7.2, inclusive, are affected. These installations belong to the Apache Software Foundation’s NiFi product line. Versions prior to 2.8.0 do not contain the fix; therefore, any deployment using those versions must be upgraded. Installations that do not employ restricted components or enforce write‑level security boundaries are not affected.

The CVSS score of 8.7 indicates high severity, but the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in the KEV catalog. Exploitation requires an attacker to already have the ability to create or modify components in the NiFi flow, typically via the UI or REST API. Once a restricted component exists, the system incorrectly accepts property updates because it does not re‑check the Restricted annotation, providing a path to privilege escalation without compromising the underlying host.