n8n versions before 2.41.4 and 2.42.0 allowed a request to the agent chat resume endpoint to supply a run identifier without checking that the suspended checkpoint belonged to the calling user. Authenticated project members could therefore list and read other members’ private agent conversations, then approve pending tool calls. The approved tools would execute and write results into the victim’s conversation, effectively revealing or altering confidential data. The primary impact is an authorization bypass that exposes private conversation content and permits unauthorized execution of tool calls.

This vulnerability affects n8n, the workflow automation platform, on any release dated before 2.41.4 and 2.42.0. Users running these older versions are vulnerable; newer releases are not impacted.

With a CVSS score of 6.1 the issue is of moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated project member who has permission to view project conversations. The attack vector is likely internal or through compromised credentials, as it relies on authorized access to the agent chat endpoints. Once an attacker gains such access, they can read private data and trigger tool calls that alter conversation content.