n8n before versions 1.123.85, 2.43.5, and 2.44.1 contains a flaw in the Chat Hub that allows users with the global:chatUser role to register restricted tool types. By exploiting this, an attacker can add and run tools through chat, enabling execution of sandboxed code, access to allowed files, and use of instance workflows, Data Tables, and agents. The weakness is a classic authorization bypass, indexed as CWE‑863.

The vulnerability affects the n8n platform distributed by n8n‑io. All installations running a version earlier than 1.123.85, 2.43.5, or 2.44.1 are at risk. Users with the global:chatUser role are the primary vectors for exploitation.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available while the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the issue via the chat interface by leveraging the global:chatUser privilege. The attack can be carried out without initial code execution or elevated system privileges, but it grants the ability to run restricted tools that may lead to further compromise of the n8n instance.