GHSA-q5xf-xhwf-cwqf: n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check

n8n versions 2.27.0 and later have a security flaw where member-level users can bypass OAuth authorization checks (a security protocol that verifies user permissions) to run workflows belonging to other users. An attacker can register an OAuth client (an application that requests permission to access resources), approve access to another user's workflow, and obtain a token (a credential proving authorization) that lets them execute that workflow, potentially accessing the owner's data while the execution appears under the owner's account.