Executive brief
n8n is a workflow automation tool used to connect different software services. A security flaw in its Public API allowed users who only had permission to view a workflow to also trigger its execution. This could lead to unauthorized automated tasks being run, potentially impacting business operations or data integrity if workflows perform sensitive actions.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in the n8n Public API execution retry endpoint. The endpoint incorrectly validated permissions using the 'workflow:read' scope instead of the required 'workflow:execute' scope. An authenticated attacker with read-only access to a shared workflow or project can exploit this via network requests to the Public API to retry and trigger workflow executions. This bypasses intended permission boundaries in multi-user or multi-project environments. The issue is resolved in versions 2.25.7 and 2.26.2.
Affected products
- n8n-io n8n >= 2.26.0, < 2.26.2; < 2.25.7
Timeline
- 2026-06-10: disclosed: Initial report by ksw9722
- 2026-06-16: advisory: GitHub Advisory published
- 2026-06-16: patched: Fixes released in versions 2.25.7 and 2.26.2