CVE-2025-52554 n8n Improper Authorization in Workflow Execution Stop Endpoint Allows Terminating Other Users’ Workflows

Medium 4.9 Published 3 Jul 2025 Updated 3 Jul 2025

Authenticated users can stop other users' workflow executions due to missing authorization checks, causing business disruption.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2025-52554?

CVE-2025-52554 is a medium-severity missing authorization vulnerability in N8n N8n, published on 3 Jul 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

n8n is a workflow automation platform. Prior to version 1.99.1, an authorization vulnerability was discovered in the /rest/executions/:id/stop endpoint of n8n. An authenticated user can stop workflow executions that they do not own or that have not been shared with them, leading to potential business disruption. This issue has been patched in version 1.99.1. A workaround involves restricting access to the /rest/executions/:id/stop endpoint via reverse proxy or API gateway.

Weakness: CWE-862

Which versions are affected by CVE-2025-52554?

2 open source packages ship an affected version, including n8n. It affects 1 product.

Package	Affected	Fixed in
`n8n` npm	All versions	`1.99.1`
`n8n` npm	All versions	`1.99.1`

Products include N8n N8n.

How do I fix CVE-2025-52554?

Upgrade n8n to 1.99.1 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-52554 being exploited?

There is no known exploitation of CVE-2025-52554 in the wild and no public exploit code.

All N8n N8n vulnerabilities

Sources

Also known as GHSA-gq57-v332-7666.