CVE-2026-72774 is an authorization bypass vulnerability in n8n's HTTP Request node affecting versions prior to 1.123.67, 2.31.5, and 2.32.1. An authenticated user with edit permissions on a shared workflow can reference another user's credential by specifying the credential type via an expression. The pre-execution permission check incorrectly compares the unresolved expression instead of the resolved credential type, skipping the ownership verification. This flaw allows the user to load and use credentials they do not own at execution time, potentially leading to unauthorized access or exfiltration of sensitive credentials. Exploitation requires knowledge of the credential identifier.

An authenticated user with edit access to a shared workflow can bypass credential ownership checks and use or exfiltrate credentials belonging to other users. This can lead to unauthorized access to sensitive systems or data that the credential protects. The vulnerability does not require UI interaction and has a high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict edit access to shared workflows to trusted users only and monitor for suspicious activity involving credential usage. Avoid sharing workflows with users who do not require credential access.