CVE-2025-52554

Katalog CVE

CVSS 4.3 · Medium EPSS 0,37%

Kerentanan Missing Authorization pada n8n. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

n8n is a workflow automation platform. Prior to version 1.99.1, an authorization vulnerability was discovered in the /rest/executions/:id/stop endpoint of n8n. An authenticated user can stop workflow executions that they do not own or that have not been shared with them, leading to potential business disruption. This issue has been patched in version 1.99.1. A workaround involves restricting access to the /rest/executions/:id/stop endpoint via reverse proxy or API gateway.

Rincian

Terbit di NVD

3 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 28,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/dudanogueira/n8n/commit/ca2f90c7fbaa1d661ade2f45d587d9469bc287e1 patch
• https://github.com/n8n-io/n8n/commit/e5edc60e344924230baafb11fa1f0af788e9ca9a patch
• https://github.com/n8n-io/n8n/pull/16405 issue tracking · patch
• https://github.com/n8n-io/n8n/security/advisories/GHSA-gq57-v332-7666 issue tracking · patch · advisory pihak ketiga