Improper access control in n8n - #VU146802
Published: September 2, 2026
Vulnerability details
The vulnerability allows a remote user to disclose workflow IDs, version IDs, activation-error details, and lifecycle event information across users.
The vulnerability exists due to improper access control in the /rest/active-workflows endpoint and workflow lifecycle event push mechanism when handling requests and broadcasting workflow events without applying a userId-based sharing filter. A remote user can access the active workflow listing or receive broadcast events to disclose workflow IDs, version IDs, activation-error details, and lifecycle event information across users.
The active workflow listing was exposed to any member regardless of sharing, and workflow activation, deactivation, and publication events were broadcast to every connected client.