n8n EUVD-2026-101724

Requires an authenticated account that is a member of a shared n8n project (PR:L), and a specific state condition reflected by AT:P: a suspended agent-chat checkpoint belonging to another user must exist and be pending tool-call approval. The attacker exploits the agent chat resume endpoint by supplying an arbitrary run identifier in the request body, which the server accepts without verifying checkpoint ownership. Limiting factors: single-user or non-shared-project deployments have no victim to target; the attack only functions while a victim checkpoint is suspended and awaiting approval; and the attacker must already hold valid project-member credentials, so this is primarily a multi-tenant/shared-project insider risk rather than remote-unauthenticated exposure.

This is a moderate-severity authorization/IDOR flaw (CWE-639) rather than a critical remote-code-execution issue, and the available signals are internally consistent. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) scores 6.1 and confirms a network-reachable but authenticated attack (PR:L = a valid, logged-in project member), with an attack requirement (AT:P) that reflects a real precondition: a suspended agent checkpoint must already exist and be pending approval. Impact is skewed toward confidentiality (VC:H - reading other members' private agent conversations) with lower integrity/availability effects (VI:L/VA:L - approving pending tool calls and writing results back). No EPSS score, no CISA KEV listing, and no public POC are present in the provided intelligence, so there is no public exploit identified at time of analysis; the realistic risk is insider/multi-tenant abuse by an already-authenticated project member rather than mass internet-wide exploitation. No signals conflict: the authenticated requirement, the lack of KEV/EPSS, and the IDOR nature all point to a 'real but scoped' issue that matters most in shared/multi-tenant n8n deployments. Note the AT:P attack requirement is not representable in CVSS 3.1, which can make a 3.1 translation look slightly more severe than warranted.

An authenticated member of a shared n8n project uses the project-scoped agent-chat endpoints to enumerate and read another member's private AI-agent conversations, then submits a resume request supplying the victim's suspended-run identifier. Because the endpoint never verifies the checkpoint belongs to the caller, the attacker approves the victim's pending tool calls, forcing those tools to execute and writing the output into the victim's conversation. No public proof-of-concept is identified in the provided data; exploitation requires only a valid low-privileged project account and an existing suspended checkpoint.