https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 21:45:34 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-110841 <p>n8n before 2.41.4 and 2.42.0 contains an authorization bypass in the agent chat resume endpoint, which accepts a run identifier from the request body without verifying that the suspended checkpoint belongs to the caller. Authenticated project members can list and read other members&#39; private agent conversations through project-scoped endpoints, then approve their pending tool calls, causing the tools to execute and write results into the victim&#39;s conversation.</p> <p>n8n before 2.41.4 and 2.42.0 contains an authorization bypass in the agent chat resume endpoint, which accepts a run identifier from the request body without verifying that the suspended checkpoint belongs to the caller. Authenticated project members can list and read other members&#39; private agent conversations through project-scoped endpoints, then approve their pending tool calls, causing the tools to execute and write results into the victim&#39;s conversation.</p> https://db.gcve.eu/vuln/fkie_cve-2026-110841 https://db.gcve.eu/vuln/ghsa-v38m-4hx4-9x2r <p>n8n before 2.41.4 and 2.42.0 contains an authorization bypass in the agent chat resume endpoint, which accepts a run identifier from the request body without verifying that the suspended checkpoint belongs to the caller. Authenticated project members can list and read other members&#39; private agent conversations through project-scoped endpoints, then approve their pending tool calls, causing the tools to execute and write results into the victim&#39;s conversation.</p> <p>n8n before 2.41.4 and 2.42.0 contains an authorization bypass in the agent chat resume endpoint, which accepts a run identifier from the request body without verifying that the suspended checkpoint belongs to the caller. Authenticated project members can list and read other members&#39; private agent conversations through project-scoped endpoints, then approve their pending tool calls, causing the tools to execute and write results into the victim&#39;s conversation.</p> https://db.gcve.eu/vuln/ghsa-v38m-4hx4-9x2r