Threats tagged 'ghsa-2rqj-qr72-7wwx'

A vulnerability in n8n versions before 2.43.5 and 2.44.x before 2.44.1 allows authenticated members with workflow creation and execution permissions to exploit a client-supplied workflow ID. By using a crafted ID such as __proto__, the application improperly caches workflow owner projects, causing project checks to match all projects. This flaw enables unauthorized listing, reading, modification, and deletion of Data Table rows across all projects within the instance.