GHSA-h3jj-5f3v-3685: n8n: Public API Execution Retry Authorization Bypass
- Identifier
- GHSA-h3jj-5f3v-3685
- Published
- Record updated
- Affected
- n8n < 2.25.7, fixed in 2.25.7, released June 10, 2026, 6 days before disclosure
- n8n >= 2.26.0, < 2.26.2, fixed in 2.26.2, released June 10, 2026, 6 days before disclosure
Summary
n8n's Public API endpoint for retrying executions checks for workflow:read instead of workflow:execute. An authenticated user with read-only access to a shared workflow can therefore retry that workflow's executions, bypassing the read/execute permission boundary. The issue affects instances where workflows are shared with other users or across projects.
Mitigation
Fixed in n8n versions 2.25.7 and 2.26.2. Upgrade to one of these versions or later. If upgrading is not immediately possible, restrict workflow sharing to fully trusted users only and restrict network access to the n8n Public API to trusted users only. These workarounds do not fully remediate the risk and are short-term measures only.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- n8nnpmDeclares an LLM dependency