n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a permission bypass vulnerability related to external secrets handling. The issue arises from a mismatch between static validation and the runtime expression engine, allowing authenticated users with credential create or update permissions—but without externalSecret:list scope—to embed external secret references undetected. These references resolve during workflow execution, exposing secret values the user should not access. This vulnerability affects only instances with an external secrets provider configured and Advanced Permissions enabled. The advisory is a duplicate and has been withdrawn in favor of GHSA-jp7m-xcgx-57qm.