Missing Authorization Affecting n8n package, versions <1.99.1


Severity

Recommended
0.0
high
0
10

CVSS assessment by Snyk's Security Team. Learn more

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Missing Authorization vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-JS-N8N-10598340
  • published4 Jul 2025
  • disclosed3 Jul 2025
  • creditpfelilpe,Luciano Sorrentino,Agustin Tedone,ffaggiani

Introduced: 3 Jul 2025

NewCVE-2025-52554  (opens in a new tab)
CWE-862  (opens in a new tab)

How to fix?

Upgrade n8n to version 1.99.1 or higher.

Overview

n8n is a n8n Workflow Automation Tool

Affected versions of this package are vulnerable to Missing Authorization over the /rest/executions/:id/stop endpoint, which can execute stop a workflow operation on workflows not owned by the user. Long-running and time-sensitive workflows are particularly vulnerable.

Workaround

This vulnerability can be avoided by restricting access to the /rest/executions/:id/stop endpoint via a reverse proxy or API gateway.

CVSS Base Scores

version 4.0
version 3.1