The vulnerability allows an editor‑level user to craft an Execute Sub‑workflow node that references a credential ID they should not have access to, bypassing the tool’s credential‑validation. This permits the attacker to use or exfiltrate credentials that they are not authorized to obtain. The weakness is identified as CWE-639, reflecting improper authorization checks.

Products from n8n‑io, specifically n8n releases prior to 1.123.67 and node.js runtimes 2.31.5 and 2.32.1, are affected. The flaw exists in all versions before the 1.123.67 patch and in the listed node.js builds.

The CVSS score is 7.2, indicating high severity. EPSS data is not available, and the vulnerability is not yet listed in the CISA KEV catalog. Attackers are likely to exploit the flaw by leveraging shared workflow permissions; a member with Editor access who knows a credential's ID can insert it into the inline JSON, which passes both save‑time and runtime validation, allowing the credential to resolve in the parent workflow’s project context and granting unauthorized access.