Threats tagged 'ghsa-x95v-p35j-q7f5'

n8n versions before 1.123.85, 2.43.5, and 2.44.1 have an authorization bypass vulnerability. This flaw allows authenticated users to access credentials they should not have permission to use by exploiting inline sub-workflow nodes with non-boolean disabled values. Attackers who know a credential ID can execute workflows in inline JSON mode, bypassing permission checks and potentially exfiltrating decrypted credentials to attacker-controlled servers.