CVE-2025-52554 - CVE House
Back to Database
Status published Medium CVE-2025-52554

n8n Improper Authorization in Workflow Execution Stop Endpoint Allows Terminating Other Users’ Workflows

Vulnerability Description

n8n is a workflow automation platform. Prior to version 1.99.1, an authorization vulnerability was discovered in the /rest/executions/:id/stop endpoint of n8n. An authenticated user can stop workflow executions that they do not own or that have not been shared with them, leading to potential business disruption. This issue has been patched in version 1.99.1. A workaround involves restricting access to the /rest/executions/:id/stop endpoint via reverse proxy or API gateway.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-52554

Credits & Attribution

No credits recorded in the NVD database.

References

More from n8n-io

View All →
CVE-2025-68949
n8n has a Webhook Node IP Whitelist Bypass via Partial String Matching
Medium 5.3
CVE-2025-68697
Self-hosted n8n has Legacy Code node that enables arbitrary file read/write
High 7.1
CVE-2025-68668
n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node
Critical 9.9
CVE-2025-68613
n8n Vulnerable to Remote Code Execution via Expression Injection
Critical 10
CVE-2025-65964
n8n Vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hook
Critical 9.4

Affected Vendor

Affected Software

n8n
Vulnerable Versions:
< 1.99.1

Timeline

Official Publish: July 3rd, 2025
Last Modified: July 3rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-862

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1078 Valid Accounts
Persistence
T1531 Account Access Removal
Impact