34Selen

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 1.123.64 n8n versions prior to 2.29.8 n8n versions prior to 2.30.1 **Description** The GraphQL node fails to enforce the Allowed HTTP Request Domains restriction on HTTP-based credentials, including Header Auth, Basic Auth, Query Auth, and OAuth. This differs from the behavior of the HTTP Request node. An authenticated user with permissions to create or edit workflows can redirect the node endpoint to a server under their control to exfiltrate restricted credentials. This issue specifically affects instances where a credential has Allowed HTTP Request Domains configured and is accessible to users who are not the owners of that credential. **Recommendations** Update to version 1.123.64 or later. Update to version 2.29.8 or later. Update to version 2.30.1 or later. Restrict workflow creation and editing permissions to fully trusted users only. Restrict credential sharing to fully trusted users only. Audit credentials with domain restrictions for unexpected sharing relationships.

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 1.123.55 n8n versions prior to 2.25.7 n8n versions prior to 2.26.2 **Description** An authorization bypass exists in the Evaluations feature within the 'POST /workflows/{workflowId}/test-runs/new' endpoint. The system incorrectly authorizes access using the `workflow:read` scope instead of the required `workflow:execute` scope. This broken access control allows an authenticated user with read-only RBAC (Role-Based Access Control) project roles to trigger a real evaluation test run. Such an action causes the workflow to execute via the internal workflow runner, potentially leading to unauthorized outbound API calls, data mutations, or other side effects in connected downstream systems. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 1.123.55 n8n versions prior to 2.25.7 n8n versions prior to 2.26.1 **Description** An authenticated user with permissions to create or modify workflows and access to a SecurityScorecard credential with limited allowed domains can configure the SecurityScorecard node's report download operation to target an attacker-controlled URL. The node attaches the SecurityScorecard API token to the outbound request, which allows the credential to be sent to an external host, bypassing configured limitations and resulting in credential exfiltration. **Recommendations** Update to version 1.123.55. Update to version 2.25.7. Update to version 2.26.1. Limit workflow creation and editing permissions to fully trusted users only. Disable the SecurityScorecard node by adding `n8n-nodes-base.securityScorecard` to the `NODES EXCLUDE` environment variable.

**Name of the Vulnerable Software and Affected Versions** Nextcloud versions 17.0.0 through 17.0.14 Nextcloud versions 18.0.0 through 18.1.11 Nextcloud versions 19.0.0 through 19.1.15 Nextcloud versions 20.0.0 through 20.1.10 Nextcloud versions 21.0.0 through 21.0.3 **Description** An Access Control List (ACL) permission bypass exists in team folders. A user granted READ and CREATE permissions, but lacking UPDATE permissions, can unauthorizedly rename files within the team folder. **Recommendations** Update to version 17.0.15 Update to version 18.1.12 Update to version 19.1.16 Update to version 20.1.11 Update to version 21.0.4

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 7.1.2 **Description** A stored Cross-Site Scripting (XSS) issue exists in the Projects component. When administrative detail views for campaigns, emails, or forms display project tags and popovers, user-supplied project names are rendered without proper sanitization. An authenticated user with permissions to create or edit projects can inject malicious script payloads. When an administrator hovers over a tag associated with a compromised project, the script executes in their browser session, potentially allowing the attacker to perform administrative actions, change system configurations, or exfiltrate sensitive data. **Recommendations** Update to version 7.1.2. Restrict project creation and modification permissions to trusted administrative users.

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 1.123.32 n8n versions prior to 2.17.4 n8n versions prior to 2.18.1 **Description** The '/chat' WebSocket endpoint used by the Chat Trigger node's Hosted Chat feature fails to verify if an incoming connection is authorized to interact with the target execution. An unauthenticated remote attacker who identifies a valid execution ID for a workflow in a waiting state can attach to that execution, receive the pending prompt intended for the legitimate user, and submit arbitrary input to resume or influence downstream workflow behavior. **Recommendations** Update to version 1.123.32. Update to version 2.17.4. Update to version 2.18.1.

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 2.4.0 n8n versions prior to 1.121.0 **Description** n8n is a workflow automation platform. When Lightweight Directory Access Protocol (LDAP) authentication is enabled, n8n automatically links an LDAP identity to an existing local account if the LDAP email attribute matches the local account's email. An authenticated LDAP user who can control their LDAP email attribute can set it to match another user's email, including an administrator's, and gain full access to that account upon login. The account linkage persists even if the LDAP email is reverted, resulting in a permanent account takeover. LDAP authentication must be configured and active for this to occur. **Recommendations** Upgrade to n8n version 2.4.0 or later. Upgrade to n8n version 1.121.0 or later. If upgrading is not immediately possible, disable LDAP authentication until the instance can be upgraded. If upgrading is not immediately possible, restrict LDAP directory permissions so that users cannot modify their own email attributes. If upgrading is not immediately possible, audit existing LDAP-linked accounts for unexpected account associations.

**Name of the Vulnerable Software and Affected Versions** Discourse versions prior to 2025.12.2 Discourse versions prior to 2026.1.1 Discourse versions prior to 2026.2.0 **Description** Discourse is an open source discussion platform. Trust Level 4 (TL4) users could publish topics into staff-only categories using the `publish to category` topic timer, bypassing intended authorization controls. **Recommendations** Update to Discourse version 2025.12.2 or later. Update to Discourse version 2026.1.1 or later. Update to Discourse version 2026.2.0 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions 3.1.0 through 3.1.6 **Description** An authorization flaw exists in Apache Airflow that could allow an authenticated user with limited task permissions to view task logs without proper authorization. The issue affects systems where users have custom permissions restricting access to task logs, but still permit task access. **Recommendations** Upgrade to Apache Airflow version 3.1.7 or later.