Executive brief
n8n is a workflow automation platform that allows organizations to connect and orchestrate business processes. An authenticated attacker can stop workflow executions started by other users without permission, disrupting time-sensitive or long-running automations and causing business disruption. This vulnerability affects environments where multiple users with different trust levels share the same n8n instance.
Technical details
The vulnerability is an improper authorization flaw (CWE-862) in the `/rest/executions/:id/stop` endpoint of n8n. While most API methods enforce user-scoped access control, the stop endpoint fails to verify that the authenticated user owns or has access to the execution they are attempting to terminate. An attacker with valid credentials can guess or enumerate execution IDs (which are sequential and partially exposed via verbose error messages) and stop any workflow execution, leading to denial of service for business-critical automations. The fix was addressed in PR #16405, and users should upgrade to version 1.99.1 or later to receive proper authorization checks.
Affected products
- n8n n8n < 1.99.1
Timeline
- 2025-07-03: disclosed