Executive brief
n8n is a workflow automation platform used to connect various business applications. A security flaw in the Enterprise and Cloud versions allowed users with restricted 'viewer' permissions to perform unauthorized actions, such as starting, canceling, or deleting workflow test runs. This could lead to unauthorized operational changes or the loss of test data within a project.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in n8n's evaluation test runs controller. Three mutating endpoints incorrectly validated actions against the 'workflow:read' OAuth scope instead of the required 'workflow:execute' scope. This allowed an authenticated attacker with the 'project:viewer' role to start new evaluation test runs, cancel active runs, and delete run records for workflows they should only be able to view. The issue specifically impacts Enterprise and Cloud instances utilizing Advanced Permissions. Patches are available in versions 1.123.55, 2.25.7, and 2.26.2.
Affected products
- n8n-io n8n < 1.123.55, >= 2.0.0-rc.0 < 2.25.7, >= 2.26.0 < 2.26.2
Timeline
- 2026-06-10: disclosed: Initial disclosure by reporter
- 2026-06-17: advisory: GitHub Advisory published