CyberRota Analysis
AI-GeneratedAuthenticated users with the default workflow:create permission in n8n versions prior to 1.123.61, 2.27.4, and 2.28.1 can exploit a vulnerability to manipulate Object.prototype via crafted workflows, potentially allowing unauthenticated requests to gain privileged access. This could expose sensitive user and project information through listing endpoints. Organizations using affected versions should prioritize upgrading to the patched releases to mitigate the risk of unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated user with the default workflow:create permission could pollute Object.prototype through a crafted workflow saved, updated, or imported via the workflow API, allowing unauthenticated requests to be treated as a privileged user and exposing user and project listing endpoints. This issue is fixed in versions 1.123.61, 2.27.4, and 2.28.1.
Related CVEs
Other vulnerabilities affecting the same vendor(s)