Technical impact
The vulnerability in n8n allows an authenticated user holding the project:viewer role to perform state‑changing operations on evaluation test runs. The flaw occurs because the API endpoints that start, cancel, or delete runs validate the OAuth token using the workflow:read scope instead of the required workflow:execute scope. As a result, a user who should only be able to view workflows can add new test runs, cancel existing ones, or delete run records.
Affected Systems
Affected installations are n8n deployments running a version earlier than 1.123.55, 2.25.7, or 2.26.2. The issue is active only when Advanced Permissions are enabled and the user has the project:viewer role. Administrators should verify that these conditions apply to their environment.
Risk and Exploitability
The CVSS score is 5.3, indicating moderate severity. The EPSS score is less than 1%, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, meaning no documented. Exploitation requires an authenticated account, Advanced Permissions, and the project:viewer role. Attackers can thus start, cancel, or delete test runs but cannot gain broader system access. The risk is limited to disruption of workflow testing and potential audit trail changes, and the likelihood of exploitation is currently low.
