js · n8nHeads-up
n8n: Evaluation test runs endpoints use wrong scope (workflow:read vs workflow:execute)
Three mutating endpoints in the evaluation test runs controller used `workflow:read` scope instead of `workflow:execute`, allowing users with `project:viewer` r
What changed
Three mutating endpoints in the evaluation test runs controller used `workflow:read` scope instead of `workflow:execute`, allowing users with `project:viewer` role to start, cancel, and delete evaluation test runs for workflows they only had read access to.
Who it affects
n8n instances with Advanced Permissions (Enterprise/Cloud) where projects and viewer roles are in use.
What to do today
Upgrade to n8n versions 1.123.55, 2.25.7, or 2.26.2 or later. If immediate upgrade is not possible, restrict project membership to trusted users and avoid granting viewer access to sensitive workflows.
The trail
Collected→
Audited→
Written→
Published
Source
GitHub Advisory · n8n