n8n Community Edition prior to versions 2.14.1, 2.13.3, and 1.123.27 contains chained authorization flaws that allow an authenticated user with a global:member role to resolve another user's credential ID through a name‑based path that does not enforce ownership. The bypass in the credential permission checker causes generic HTTP credential types to be skipped during pre‑execution validation, enabling the member to execute a workflow that decrypts and uses that credential. The result is the disclosure of plaintext secret values from httpBasicAuth, httpHeaderAuth, and httpQueryAuth credential types belonging to other users.

The vulnerability affects only the n8n Community Edition deployed on any instance running a version older than 2.14.1, 2.13.3, or 1.123.27. Enterprise Edition is not affected because it implements additional permission gates that block the attack chain. Users of the cited versions must check their deployment and ensure they are on a patched release.

The CVSS score of 8.5 indicates a high‑severity impact. The attack requires an authenticated user with member privileges, so it would not be usable by unauthenticated actors. While the EPSS score is not available and the issue is not listed in the CISA KEV catalog, the logical attack path—namely authenticating, resolving a credential by name, and executing a workflow—does not require sophisticated prerequisites, making the exploitation achievable for an in‑place attacker. The vulnerability’s impact is the loss of secret confidentiality and potential lateral movement within the workflow platform.