The flaw in n8n allows an authenticated user who only has workflow‑read permissions to request a test execution of a workflow. The POST /workflows/{workflowId}/test‑runs/new endpoint erroneously authorizes using the read scope instead of the required execute scope, which causes the internal workflow runner to perform the full workflow with its configured outbound calls, data writes, or other side effects.

All n8n installations running 1.123.55 or earlier, or 2.25.7 or earlier, or 2.26.2 or earlier are vulnerable. The issue is most relevant when the Evaluations feature is enabled and RBAC project roles grant workflow‑read rights while denying workflow‑execute rights.

The CVSS score of 5.3 indicates moderate severity. With an EPSS score of less than 1% the likelihood of exploitation is very low, and the vulnerability is not listed in the CISA KEV catalog. An attacker only needs to authenticate and possess workflow‑read permissions on a target workflow to trigger a full execution through the test‑run endpoint.