Ksw9722

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 2.25.7 n8n versions 2.26.x prior to 2.26.2 **Description** An authorization bypass exists in the Public API execution retry endpoint. The system incorrectly authorizes access using the `workflow:read` scope instead of the required `workflow:execute` scope. This allows an authenticated user who only has read-only access to a shared workflow to retry executions of that workflow, bypassing the permission boundary between read and execute access. This issue occurs in instances where workflows are shared across projects or with other users. **Recommendations** Update n8n to version 2.25.7 or later. Update n8n to version 2.26.2 or later.

**Name of the Vulnerable Software and Affected Versions** lucy-xss-filter versions prior to commit 7c1de6d **Description** The software contains a flaw that allows an attacker to trigger server-side HEAD requests to arbitrary URLs. This occurs when the ObjectSecurityListener or EmbedSecurityListener option is enabled and embed or object tags are used with a src attribute lacking a file extension. **Recommendations** Update to version 7c1de6d or later.