# org.apache.nifi:nifi-web-api (Maven) vulnerabilities

9 known vulnerabilities (2 high, 1 medium, 4 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Dependents: 5
- Registry: https://central.sonatype.com/artifact/org.apache.nifi/nifi-web-api

## Advisories (9)

### [CVE-2026-81866](https://cve.now/CVE-2026-81866): Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration

- Severity: Low 0.5
- Published: Sep 16, 2026
- Affected: from 2.9.0, through 2.11.0.

### [CVE-2026-82561](https://cve.now/CVE-2026-82561): Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods

- Severity: Medium 5.9
- Published: Sep 16, 2026
- Affected: from 1.5.0, through 2.11.0.

### [CVE-2026-86089](https://cve.now/CVE-2026-86089): Apache NiFi: Missing Process Group Authorization for Connector Migration

- Severity: Low 2.3
- Published: Sep 16, 2026
- Affected: versions 2.11.0.

### [CVE-2026-44914](https://cve.now/CVE-2026-44914): Apache NiFi: Missing Authorization of Restricted Permissions when Replacing Flow Contents

- Severity: High 7.5
- Published: Jun 22, 2026
- Affected: from 1.12.0, through 2.9.0; from 1.12.0, fixed in 2.9.0.

### [CVE-2026-44911](https://cve.now/CVE-2026-44911): Apache NiFi: Incorrect Authorization for Configuration Verification Requests

- Severity: Low 2.3
- Published: Jun 22, 2026
- Affected: from 1.15.0, through 2.9.0; from 1.15.0, fixed in 2.10.0.

### [CVE-2026-25903](https://cve.now/CVE-2026-25903): Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates

- Severity: High 8.7
- Published: Feb 17, 2026
- Affected: from 1.1.0, fixed in 2.8.0.

### [CVE-2024-56512](https://cve.now/CVE-2024-56512): Apache NiFi: Missing Complete Authorization for Parameter and Service References

- Severity: Low 2.1
- Published: Dec 28, 2024
- Affected: from 1.10.0, through 2.0.0; from 1.10.0, fixed in 2.1.0.

### [CVE-2019-10083](https://cve.now/CVE-2019-10083): When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents (at…

- Severity: Unrated
- Published: Nov 19, 2019
- Affected: from 1.3.0, fixed in 1.10.0.

### [CVE-2019-12421](https://cve.now/CVE-2019-12421): When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the…

- Severity: Unrated
- Published: Nov 19, 2019
- Affected: from 1.3.0, fixed in 1.10.0.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.apache.nifi:nifi-web-api
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.