Description
n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization vulnerability in three mutating evaluation test-run endpoints that authorize state-changing actions using the workflow:read scope instead of the action-appropriate workflow:execute scope. On instances using Advanced Permissions (Enterprise/Cloud) with projects and viewer roles, an authenticated user with the project:viewer role can start new evaluation test runs, cancel in-flight runs, and delete run records for workflows they only have read access to.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| n8n | n8n | < 1.123.55, 2.26.0 – < 2.26.2, 2.0.0-rc.0 – < 2.25.7 | 1.123.55 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | n8n | < 1.123.55 | 1.123.55 | GHSA-664h-gpgq-h6xx |
| npm | n8n | >= 2.26.0, < 2.26.2 | 2.26.2 | GHSA-664h-gpgq-h6xx |
| npm | n8n | >= 2.0.0-rc.0, < 2.25.7 | 2.25.7 | GHSA-664h-gpgq-h6xx |
Advisories 1
- WID-SEC-2026-1875 n8n: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 8, 2026
References
- GitHub Security Advisory (GHSA-664h-gpgq-h6xx) vendor-advisory
- VulnCheck Advisory: n8n - Incorrect OAuth Scope Validation in Evaluation Test Runs Endpoints third-party-advisory