n8n before version 1.123.83 contains an authorization bypass that lets users editing shared workflows embed credentials they normally cannot use. The embedded credentials are executed as the workflow owner, granting the attacker unauthorized access to the credential's permissions. As a result, the attacker can retrieve data or perform actions that should be restricted to the credential holder, potentially exposing sensitive resources.

This flaw affects the n8n automation platform released by n8n‑io, specifically all versions older than 1.123.83. Clients running any of those releases are susceptible until they apply the vendor patch that appears in version 1.123.83 or later.

The CVSS score of 7.2 indicates a high severity issue, though the EPSS score is not available and the vulnerability is not currently listed in CISA’s KEV catalog. Attackers would need the ability to edit shared workflows, meaning the threat surface is limited to users with editing rights, but within that scope the exploit bypasses credential restrictions entirely. The exploitation path involves embedding a tool or workflow retriever inline definition that references a restricted credential; when the owner executes the workflow, the credential is used, giving the attacker the owner’s privilege level.