CVE-2025-52554: 
JavaScript vulnerability analysis and mitigation

CVE-2025-52554 is an improper authorization (Missing Authorization) vulnerability in the n8n workflow automation platform affecting the /rest/executions/:id/stop REST API endpoint. All n8n versions prior to 1.99.1 (distributed as an npm package) are affected. The vulnerability was published on July 3, 2025, with the fix merged on June 18, 2025 and released in version 1.99.1 on June 19, 2025. It carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 4.9 (Medium) (GitHub Advisory, Github Advisory).

The root cause is CWE-862 (Missing Authorization): the /rest/executions/:id/stop endpoint used a direct parameter reference to look up an execution without verifying that the requesting user owns or has been granted access to the associated workflow. While most other API methods in n8n enforce user-scoped access by filtering executions through shared workflow IDs, the stop endpoint called executionRepository.findSingleExecution() directly with only the execution ID, bypassing ownership checks entirely. The fix (PR #16405) modified the ExecutionService.stop() method to accept a sharedWorkflowIds parameter and use findWithUnflattenedData() — which filters by accessible workflow IDs — ensuring only authorized users can terminate an execution. Execution IDs are sequential and partially exposed via verbose error messages, making enumeration feasible for an authenticated attacker (GitHub Advisory, n8n PR #16405).

An authenticated low-privileged user can terminate any active workflow execution on a shared n8n instance, regardless of ownership or sharing permissions. This primarily affects integrity and availability: attackers can disrupt business-critical automations, cause denial of service for long-running or time-sensitive workflows (e.g., those using the wait node), and interfere with other users' automated processes. There is no confidentiality impact — the vulnerability does not expose data — but operational disruption in multi-tenant or team environments can be significant (GitHub Advisory, Github Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.327% (56th percentile), indicating a low but non-negligible probability of exploitation within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only a valid authenticated session (low privileges), making it accessible to any registered user on a shared n8n instance, and the sequential nature of execution IDs lowers the bar for ID enumeration.

1. Obtain authenticated access: Register or log in to a shared n8n instance with any valid user account (low-privilege access is sufficient).
2. Enumerate execution IDs: Since execution IDs are sequential and partially exposed via verbose API error messages, send requests to the /rest/executions/ listing endpoint or probe the stop endpoint with incrementing IDs to identify active executions belonging to other users.
3. Identify target executions: Look for executions in running or waiting status that belong to other users (e.g., long-running workflows using the wait node).
4. Send unauthorized stop request: Issue an HTTP POST request to /rest/executions/<target_id>/stop using your authenticated session cookie or API token. In vulnerable versions, no ownership check is performed, so the server will terminate the target execution.
5. Confirm disruption: Observe that the target workflow execution is stopped, causing business disruption for the workflow owner without their consent (GitHub Advisory, n8n PR #16405).

• Network: Repeated HTTP POST requests to /rest/executions/<id>/stop from a user account that does not own the targeted workflows; requests targeting sequential or incrementing execution IDs from a single source IP.
• Logs: n8n application logs showing MissingExecutionStopError or stop requests for execution IDs not associated with the requesting user's workflows; unusual volume of stop requests from a single authenticated user.
• Behavioral: Unexpected termination of long-running or waiting workflow executions; workflow owners reporting their automations stopping without user action; patterns of executions being stopped shortly after creation by a different user account.

Upgrade n8n to version 1.99.1 or later, which enforces proper authorization checks in the /rest/executions/:id/stop endpoint by validating that the execution belongs to a workflow accessible to the requesting user (GitHub Advisory, n8n PR #16405). As a temporary workaround for environments that cannot immediately upgrade, restrict access to the /rest/executions/:id/stop endpoint via a reverse proxy or API gateway, limiting which users or IP ranges can reach it. Organizations running multi-user n8n instances with mixed trust levels should prioritize this update.