{"action":"Upgrade org.apache.nifi:nifi-web-api to 2.8.0 or later.","affected":[{"fixed":"2.8.0","introduced":"1.1.0"}],"component":"org.apache.nifi:nifi-web-api","cve_ids":["CVE-2026-25903"],"ecosystem":"Maven","epss":0.00752,"exploited":false,"fixed_versions":["2.8.0"],"ghsa_id":"GHSA-c5w7-m8wf-xc77","id":"tcs_01M5N8RPCM7YVRGV415WBBQ8M5","modified_at":"2026-02-20T09:26:10.935834Z","published_at":"2026-02-17T12:31:07Z","references":["https://osv.dev/vulnerability/GHSA-c5w7-m8wf-xc77","https://nvd.nist.gov/vuln/detail/CVE-2026-25903","https://github.com/apache/nifi/commit/119f8881fbc3cbd0d522b0c549b841da3de01f64","https://github.com/apache/nifi","https://issues.apache.org/jira/browse/NIFI-15567","https://lists.apache.org/thread/jf6bkt9sk6xvshy8xyxv3vtlxd340345","http://www.openwall.com/lists/oss-security/2026/02/16/1"],"severity":{"label":"medium","score":6.6},"sources":[{"source":"osv","source_id":"GHSA-c5w7-m8wf-xc77","url":"https://osv.dev/vulnerability/GHSA-c5w7-m8wf-xc77"},{"source":"nvd","source_id":"CVE-2026-25903","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25903"}],"summary":"Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates"}