Executive brief
n8n is a workflow automation tool used to connect different business applications and automate tasks. A security flaw allowed users who should only be able to view workflows to actually run them. This could lead to unauthorized data changes or unintended actions in connected business systems, such as sending emails or modifying database records.
Technical details
An improper access control vulnerability (CWE-284) exists in the n8n Evaluations feature. The 'POST /workflows/{workflowId}/test-runs/new' endpoint incorrectly required the 'workflow:read' OAuth scope instead of 'workflow:execute'. An authenticated attacker with read-only permissions can trigger a real evaluation test run, causing the workflow to execute via the internal runner. This allows for unauthorized execution of workflow logic, potentially leading to outbound API calls and data modifications in integrated services. The issue is fixed in versions 1.123.55, 2.25.7, and 2.26.2.
Affected products
- n8n-io n8n < 1.123.55, >= 2.0.0-rc.0, < 2.25.7, >= 2.26.0, < 2.26.2
Timeline
- 2026-06-10: disclosed: Initial disclosure by reporter
- 2026-06-16: advisory: GitHub Advisory published