A member‑level user with editor rights on a shared workflow in n8n can retrieve credentials belonging to other users through specific public API endpoints. The credential ownership checks are only partially enforced, allowing cross‑user access that was not intended. This flaw permits an attacker with such privileges to exfiltrate sensitive authentication tokens and other private information, compromising the confidentiality of user accounts. The weakness is identified as CWE‑863, an improper restriction of resources for a specific user.

The affected product is n8n, developed by n8n‑io. Versions prior to 1.123.55, 2.25.7, and 2.26.2 are vulnerable. The issue occurs when workflow sharing is enabled and at least one workflow is shared with a member‑level user as an Editor. All installations that meet these conditions are at risk until the recommended versions are applied.

The CVSS score of 8.5 classifies this as a high‑severity vulnerability. EPSS information is not available, so the exploitation probability cannot be precisely quantified; however the flaw can be reached via public API endpoints, meaning that an attacker only needs network access to the n8n instance. The vulnerability is not currently listed in CISA’s KEV catalog. Because any editor on a shared workflow can exploit the bypass, the potential impact is significant with relative ease of exploitation once the conditions are met.