CVE-2025-52554 json
n8n Improper Authorization in Workflow Execution Stop Endpoint Allows Terminating Other Users’ Workflows
published last yr. modified 4mo ago also EUVD-2025-19898 , GHSA-gq57-v332-7666
- cvss
- 4.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 30%
- public exploits
- 0
- none known
Summary
n8n is a workflow automation platform. Prior to version 1.99.1, an authorization vulnerability was discovered in the /rest/executions/:id/stop endpoint of n8n. An authenticated user can stop workflow executions that they do not own or that have not been shared with them, leading to potential business disruption. This issue has been patched in version 1.99.1. A workaround involves restricting access to the /rest/executions/:id/stop endpoint via reverse proxy or API gateway.
Patch / fix
- npm n8n 1.99.1
- n8n n8n 1.99.1
- github.com/dudanogueira/n8n@ca2f90c commit
- github.com/n8n-io/n8n@e5edc60 commit
- github.com/n8n-io/n8n#16405 pull request
- github.com/n8n-io/n8n/security/advisories/GHSA-gq57-v332-7666 advisory
Is CVE-2025-52554 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.37% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 4.9 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:H |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| CNA | 4.0 | 4.9 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | n8n | <1.99.1 |
1.99.1 |
Affected products
- n8n-io n8n
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/n8n-io/n8n/pull/16405
web, issue-tracking, patch
-
github.com
/dudanogueira/n8n/commit/ca2f90c7fbaa1d661ade2f45d587d9469bc287e1
web, patch
-
github.com
/n8n-io/n8n/commit/e5edc60e344924230baafb11fa1f0af788e9ca9a
web, patch
-
github.com
/n8n-io/n8n/security/advisories/GHSA-gq57-v332-7666
web, issue-tracking, patch, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-52554
advisory
-
github.com
/n8n-io/n8n
package
Sources
- CVE List CVE-2025-52554
- GitHub Advisory GHSA-gq57-v332-7666
- NVD CVE-2025-52554
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.