The vulnerability arises when the NiFi framework fails to enforce the Restricted annotation during process group replacement. A user granted general write access can replace a process group that contains components requiring restricted rights and thus add those components without the necessary authorization. This creates an elevation of privilege path that can allow the attacker to deploy components with elevated capabilities or sensitive configurations without being subject to the normal restricted permission checks.

Apache NiFi versions 1.12.0 through 2.9.0 are affected. The issue exists in the default installation of NiFi from the Apache Software Foundation. Systems that have applied tighter write permissions or that have custom authorization may not be vulnerable, but the vulnerability remains in the core framework until the latest version.

The CVSS base score is 7.5, indicating a high severity. EPSS information is not available and the vulnerability is not yet in the CISA KEV catalog. Exploitation requires the attacker to possess write privileges on the NiFi instance; there is no known remote execution vector independent of that. The risk is therefore limited to users who already have write access, but the impact of adding restricted components can be significant, especially if those components expose additional hooks or data. The lack of formal authorization checks means any write‑capable user can elevate their privileges within the flow, making the vulnerability a serious concern for environments that rely on the Restricted annotation to enforce sensitive component boundaries.