The vulnerability permits an authenticated member to spoof a workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode. This mis‑authentication enables the attacker to resolve credentials from projects they do not belong to and to modify another workflow’s static data and error‑workflow dispatch, compromising confidentiality, integrity, and availability of the affected system.

The affected product is n8n by n8n‑io. Versions of the software prior to 1.123.83 are vulnerable; the issue is present in all versions released before that patch release.

The CVSS score of 7.1 classifies the flaw as a high‑severity authorization bypass. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed exploitation yet. However, the likely attack vector requires only authenticated access to the platform and the ability to execute a sub‑workflow with inline JSON, making the vulnerability exploitable by any user with those privileges. The potential impact includes unauthorized credential access and arbitrary modification of workflow logic, posing a significant risk to organizational data and process integrity.