n8n versions starting from 2.27.0, when the OAuth 2.1 consent and token issuance flow was introduced, through versions before 2.29.8 and 2.30.x before 2.30.1, do not verify that the authenticated user has access rights to the workflow referenced as the OAuth resource. This allows a member-level user to register an OAuth client, self-approve consent for workflows owned by other users, and obtain valid tokens. Consequently, the attacker can execute workflows in the context of the workflow owner, using the owner's stored credentials, and manipulate inputs and outputs, potentially accessing sensitive data from the owner's connected integrations. This breaks user and project isolation controls. The advisory is marked as a duplicate and withdrawn, with no patch links provided here.

An attacker with member-level access can bypass OAuth authorization checks to execute workflows belonging to other users, running them with the owner's credentials. This compromises user and project isolation, potentially exposing sensitive data from integrations connected to the owner's workflows. The vulnerability allows unauthorized workflow execution and data access within the affected n8n instances.

Patch status is not yet confirmed — check the vendor advisory GHSA-q5xf-xhwf-cwqf for current remediation guidance. Since this advisory is a duplicate and withdrawn, refer to the original advisory for official fixes or mitigation steps.