Authorization Bypass in n8n Workflow Evaluation

Compliance Impact

The provided information does not specify any direct impact or implications of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in n8n versions before 1.123.55, 2.25.7, and 2.26.2, where three mutating evaluation test-run endpoints incorrectly use the workflow:read OAuth scope instead of the required workflow:execute scope to authorize state-changing actions.

As a result, an authenticated user with the project:viewer role, which normally only grants read access, can start new evaluation test runs, cancel ongoing runs, and delete run records for workflows they should only be able to view.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows users with limited read-only permissions (project:viewer role) to perform unauthorized state-changing actions such as starting, canceling, or deleting evaluation test runs on workflows they only have read access to.

The impact includes moderate integrity and availability risks because unauthorized users can alter or disrupt workflow evaluation runs, potentially affecting system operations or data related to those workflows.

The vulnerability requires low privileges and no user interaction to exploit, making it easier for attackers within the system to misuse these permissions.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, users should upgrade n8n to versions 1.123.55, 2.25.7, or 2.26.2 or later, where the issue has been patched.

As a temporary mitigation, restrict project membership to trusted users and avoid granting the project:viewer role to users who should not have the ability to start, cancel, or delete evaluation test runs, especially on sensitive workflows. However, these mitigations do not fully resolve the risk.

Useful 0 Not Useful 0