n8n Public API Execution Retry Authorization Bypass Vulnerability

A vulnerability exists in n8n versions prior to 2.25.7 and 2.26.x prior to 2.26.2, allowing an authorization bypass in the Public API execution retry endpoint. The vulnerability arises because access is authorized using the workflow:read scope instead of the workflow:execute scope. This flaw enables an authenticated user with read-only access to a shared workflow to use the Public API to retry executions of that workflow, thereby bypassing the intended permission boundary between read and execute access. The issue is particularly relevant in instances where workflows are shared with other users or across projects.

Impact

Exploitation of this vulnerability allows for unauthorized execution retries on workflows, bypassing established permission boundaries and potentially leading to unintended workflow executions or actions.

Remediation

Users can upgrade to n8n versions 2.25.7 or 2.26.2 and later to address this vulnerability. If an immediate upgrade is not possible, consider restricting workflow sharing to trusted users and limiting network access to the n8n Public API to trusted users only.