Apache NiFi versions 1.10.0 through 2.10.0 expose a Parameter Context update REST endpoint that does not enforce component‑level authorization. An authenticated user with write rights on a Parameter Context can modify parameter values that are referenced by other components, even if the user lacks permission to modify those components. If the parameter contains executable script content, the change triggers code execution during component validation, although the affected component remains stopped.

Affected systems are deployments of Apache NiFi produced by the Apache Software Foundation, specifically versions 1.10.0 to 2.10.0 inclusive. The vulnerability does not apply to releases newer than 2.10.0.

The CVSS score of 5.9 indicates a moderate severity. No EPSS score is available and the issue is not listed in CISA’s KEV catalog, suggesting a lower likelihood of widespread exploitation. The attack requires an authenticated user who can alter a Parameter Context; if the user does not have write access to the referenced components, the exploitation still allows unauthorized modification of parameter values and potential code execution during validation, but does not affect running components.