IA Squad
SearchPT
js · n8nHeads-up

n8n: Evaluation test runs endpoints use wrong scope (workflow:read vs workflow:execute)

Three mutating endpoints in the evaluation test runs controller used `workflow:read` scope instead of `workflow:execute`, allowing users with `project:viewer` r

18 Jun 2026Read 1 minSeverity: schedule it

What changed

Three mutating endpoints in the evaluation test runs controller used `workflow:read` scope instead of `workflow:execute`, allowing users with `project:viewer` role to start, cancel, and delete evaluation test runs for workflows they only had read access to.

Who it affects

n8n instances with Advanced Permissions (Enterprise/Cloud) where projects and viewer roles are in use.

What to do today

Upgrade to n8n versions 1.123.55, 2.25.7, or 2.26.2 or later. If immediate upgrade is not possible, restrict project membership to trusted users and avoid granting viewer access to sensitive workflows.

The trail
Collected Audited Written Published