n8n contains a flaw in the Public API execution retry endpoint that authorizes executions using a workflow:read scope instead of the intended workflow:execute scope. An attacker who can authenticate and has read‑only access to a shared workflow can therefore trigger executions of that workflow, bypassing the defined permission boundary between read and execute access. The attack can reveal sensitive data or invoke downstream processes, exposing the system to unauthorized operations. The weakness is an instance of authorization misuse and is catalogued as CWE-863.

The affected product is n8n, the open‑source workflow automation platform. All installations of n8n are vulnerable when running a version earlier than 2.25.7 or a 2.26.x release earlier than 2.26.2. The issue manifests in environments where workflows are shared between users or across projects, allowing read‑only collaborators to exploit the retry endpoint.

The CVSS score of 5.3 indicates a medium severity, and the EPSS score of < 1% suggests a low probability of exploitation in the current threat landscape. The vulnerability is not present in the CISA KEV catalog. Exploitation requires a valid authenticated session for a user who has read permissions on a workflow. The attacker can invoke the public API over the network, likely through an HTTP request to the retry endpoint. Once executed, the permission boundary is violated, allowing the attacker to perform actions that should have required higher authority. The risk is amplified when the public API is exposed to broader network segments or the internet without additional safeguards.