An authorization bypass exists in the Agents create endpoint of n8n prior to versions 2.41.4 and 2.42.1. The endpoint accepts a caller‑supplied Agent ID, verifies permissions only against the requested project, and updates an existing Agent without checking which project originally owns it. An authenticated user who has read‑only access to agents in another project can therefore cause that Agent to be moved into their own project and overwrite its name, schema and version, effectively hijacking a resource across projects.

The vulnerability affects n8n deployments by n8n‑io running versions earlier than 2.41.4 and those between 2.41.4 and 2.42.0; any installation with these versions is susceptible.

The CVSS score of 6.1 indicates moderate severity. No EPSS data is available and the flaw is not listed in CISA’s KEV catalog. The likely attack vector is via the web API Agents create endpoint, and the vulnerability requires only an authenticated user with minimal agent access in the target project, a condition that is commonly met in multi‑tenant environments. Because the exploitation path is straightforward and requires no special conditions beyond legitimate credentials, the theoretical risk remains significant for organizations with loose project isolation.