CyberRota Analysis
AI-GeneratedThe vulnerability affects n8n versions prior to 1.123.55, 2.25.7, and 2.26.2, allowing authenticated users with the project:viewer role to perform unauthorized state-changing actions on workflows, such as starting and canceling evaluation test runs, as well as deleting run records. This misconfiguration in authorization checks could lead to potential data manipulation and workflow disruption. Organizations utilizing Advanced Permissions in n8n should prioritize patching to mitigate the risk of unauthorized actions by users with limited access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization vulnerability in three mutating evaluation test-run endpoints that authorize state-changing actions using the workflow:read scope instead of the action-appropriate workflow:execute scope. On instances using Advanced Permissions (Enterprise/Cloud) with projects and viewer roles, an authenticated user with the project:viewer role can start new evaluation test runs, cancel in-flight runs, and delete run records for workflows they only have read access to.
Related CVEs
Other vulnerabilities affecting the same vendor(s)