PT-2025-27832 · N8N · N8N

Agustedone + 3 · Published 2025-07-03 · Updated 2025-07-03 · CVE-2025-52554

Positive Technologies (AI Summary)

CVSS v4.0

4.9

Medium

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:H

Name of the Vulnerable Software and Affected Versions: n8n versions prior to 1.99.1

Description: n8n is a workflow automation platform. An authorization issue was found in the "/rest/executions/:id/stop" endpoint, allowing an authenticated user to stop workflow executions they do not own or that have not been shared with them. This could lead to potential business disruption.

Recommendations: For versions prior to 1.99.1, update to version 1.99.1 to resolve the issue. As a temporary workaround, consider restricting access to the "/rest/executions/:id/stop" endpoint via reverse proxy or API gateway.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-52554

GHSA-GQ57-V332-7666

Affected Products

N8N

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52554.json · Exploit
• https://github.com/n8n-io/n8n/pull/16405 · Patch
• https://github.com/n8n-io/n8n/commit/e5edc60e344924230baafb11fa1f0af788e9ca9a · Patch
• https://github.com/n8n-io/n8n/security/advisories/GHSA-gq57-v332-7666 · Patch
• https://osv.dev/vulnerability/CVE-2025-52554 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52554 · Security Note
• https://github.com/dudanogueira/n8n/commit/ca2f90c7fbaa1d661ade2f45d587d9469bc287e1 · Patch
• https://osv.dev/vulnerability/GHSA-gq57-v332-7666 · Vendor Advisory
• https://github.com/n8n-io/n8n · Note
• https://twitter.com/CVEnew/status/1940876697903247635 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1940908875265327359 · Twitter Post