This vulnerability allows an authenticated user with read-only access to a workflow to trigger a real evaluation test run. The POST /workflows/{workflowId}/test-runs/new endpoint incorrectly authorizes the operation using the workflow:read scope rather than the required workflow:execute scope. The result is that the workflow runs via the internal runner, producing outbound API calls, data mutations, or other side effects in downstream systems. The weakness is an example of CWE-863: Misplaced or Inadequate Authorization.

n8n instances with versions 1.123.55 and earlier, 2.25.7 and earlier, and 2.26.2 and earlier are affected. The issue is most relevant for deployments that enable the Evaluations feature and where RBAC project roles grant workflow:read without workflow:execute.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated POST request to the test-run endpoint by any user holding workflow:read privileges, allowing the attacker to execute the workflow and cause unintended side effects without needing elevated permissions.