js · n8nHeads-up
n8n Public API Retry Execution Authorization Bypass
The Public API endpoint for retrying executions used `workflow:read` instead of `workflow:execute` for authorization, allowing read-only users to retry executio
What changed
The Public API endpoint for retrying executions used `workflow:read` instead of `workflow:execute` for authorization, allowing read-only users to retry executions.
Who it affects
Instances where workflows are shared with other users or across projects, and authenticated users with read-only access to a shared workflow.
What to do today
Upgrade n8n to version 2.25.7 or 2.26.2 or later. If immediate upgrade is not possible, restrict workflow sharing to fully trusted users and restrict network access to the Public API.
The trail
Collected→
Audited→
Written→
Published
Source
GitHub Advisory · n8n