{"schema":"threatline.record/2","record":{"id":"GHSA-866p-xg8v-g2q7","aliases":["GHSA-866p-xg8v-g2q7"],"summary":"Execute Sub-workflow Inline JSON Allows Member to Spoof Workflow Identity for Credential Authorization, Static Data, and Error-Workflow Dispatch","details":"## Impact\r\n\r\nExecute Sub-workflow's inline JSON mode carried an identifier that was then trusted as workflow metadata: it selected the project authorising the sub-workflow's credentials, the row receiving static data, and the workflow the run is recorded under. The party being authorised therefore supplied the identity the decision was made against. A member could have credentials resolved from a project they do not belong to and affect another workflow's stored state.\r\n\r\n## Patches\r\n\r\nThe issue has been fixed in n8n versions 1.123.83. Users should upgrade to one of these versions or later to remediate the vulnerability.\r\n\r\n## Workarounds\r\n\r\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\r\n- Restrict n8n instance access to fully trusted users only.\r\n- Audit and restrict membership to the minimum set of users who require access to the instance.\r\n- Monitor execution logs for unexpected sub-workflow executions originating from webhook-triggered workflows owned by lower-privileged members.\r\n\r\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","categories":["Frameworks"],"product":"n8n","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-866p-xg8v-g2q7","source_modified_at":"2026-09-30T15:10:40Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 1.123.83"}],"fixed_versions":[],"cvss":7.1,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-09-30T08:35:28Z","modified_at":"2026-09-30T15:10:40Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-866p-xg8v-g2q7","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-30T15:10:40Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-30T15:10:40Z","content_hash":"395e8451ccc87432a279fb2d9909cfcc5832141da7a37d40401301824d80665e"}}