The vulnerability allows an authenticated API user who possesses a key with the variable:list permission to retrieve workflow variables from any project by supplying an arbitrary projectId in the public API variables endpoint. Because the endpoint bypasses the normal authorization checks, an attacker can read variables that may contain sensitive data such as credentials or tokens, resulting in data leakage.

n8n‑io’s n8n platform, versions older than 1.123.32, 2.17.4, and 2.18.1. The issue applies only to licensed enterprise or team deployments that host multiple projects and have the variables feature enabled.

The CVSS score of 6 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. A legitimate user with a variable:list scoped API key can exploit the flaw by calling the public API with a crafted projectId, thereby bypassing project membership checks. The attack requires no additional privileges beyond the API key scope and can lead to exposure of sensitive configuration data.