THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-65xw-2v52-jhxc (medium) — n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter

[GHSA] GHSA-65xw-2v52-jhxc (medium) — n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter

medgithub_advisoriesPublished 2026-09-10

GHSA-65xw-2v52-jhxc Severity: medium CVE: CVE-2026-86994

n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter

## Impact

The endpoint `/rest/active-workflows` returned every active workflow ID on the instance to any member, regardless of sharing, and workflow activation, deactivation and publication push events were broadcast to every connected client, carr

Indicators of compromise

CVE-2026-86994cve

Original source: https://github.com/advisories/GHSA-65xw-2v52-jhxc