n8n versions prior to 2.28.0 contain an improper authorization flaw in the workflow creation process that allows an authenticated user to assign a workflow to a folder that resides in another project. By supplying a crafted request payload, the attacker bypasses project and folder level access controls, resulting in a logical integrity violation where workflows can be relocated outside their intended project context. This vulnerability is classified as CWE-639, reflecting improper authorization of access controls. The impact is the unauthorized manipulation of the target project’s folder structure and the potential exposure or loss of confidential automation logic.

All instances of the n8n automation platform running a version earlier than 2.28.0 are vulnerable, irrespective of how the software is installed or deployed. The flaw resides in the workflow creation API that maps workflows to folder identifiers within the n8n server. Any user with valid credentials who has permission to create or modify workflows can exploit the issue.

The CVSS score of 5.3 indicates moderate overall risk. The EPSS score of < 1% reflects a very low current probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that the attacker already possesses valid user credentials capable of creating or editing workflows. The likely attack vector is inferred from the description; it involves sending a crafted API request to the workflow creation endpoint. No remote code execution or privilege escalation is disclosed in the available data.