n8n 2.45.7 stable patch requires execution:read for workflow-scoped execution data routes
n8n released patch versions 2.46.3 on its beta line, 2.45.7 on stable, and 1.123.91 on the legacy 1.x series on 30 October. Only the 2.45.7 release notes list a security hardening fix, which makes workflow-scoped routes enforce the execution:read scope before returning execution data. Previously, users whose roles covered workflow scopes but not execution scopes could receive that data through these routes. A related change aligns the AI Assistant so it also requires execution:read to read executions or add recent runs to its context. No GitHub security advisory for this change appears as of publication, and operators are advised to upgrade and review custom roles, since integrations relying on the old behavior will need the execution:read scope added explicitly.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
Discussion (0)
Log in to join the discussion and vote.
Log in