n8n - 💡(How to fix) Fix Bug: No Folder-level Permissions & Credential Isolation Causes Security and Privacy Issues

Bug Description

When using n8n with a Starter or higher plan, multiple users are able to join a workspace and create their own folders for team or client work. However, any member can access, modify, or use credentials from any other member's folder. There are currently no folder-level permissions or isolation for credentials. This causes security and privacy issues, especially for agencies, consultants, or teams handling different clients and sensitive workflows.

Example: Members A, D, E should be able to access a protected folder, but members B, C should not. However, with current n8n design:

• Any team member can enter or edit any folder, regardless of assignment or desired restriction.
• Credentials created in one folder can be accessed and used in another user's workflows or folders by other members.
• There is no way to password-protect or lock a folder for a specific group of members.

Owner/administrator access to everything is expected, but user-level isolation is not possible.

To Reproduce

1. A team owner adds members A, B, C, D, and E to a shared workspace (Starter plan or above).
2. Member D creates a folder 'Project Delta' and expects to invite only A, D, and E.
3. Any member (B or C) can enter 'Project Delta', view or edit workflows, and use credentials stored there.
4. D cannot prevent B or C from accessing the folder or credentials without restricting the entire workspace.

Expected behavior

• Folder owners or admins should be able to restrict access to certain folders to specific members.
• There should be an option to make folders private or protected (by password or membership).
• Credentials created or stored in a folder should not be accessible by other members unless explicitly shared.
• Team members should only see or use the folders and credentials they have access to.
• Owner/admins should be able to override any protection (for recovery, audit, or compliance).

Debug Info

Applies to all n8n deployments (Cloud and Self-hosted) and all platforms. Commonly observed on shared starter and business plans with team collaboration.

Operating System

All (Linux, MacOS, Windows, Docker, Cloud)

n8n Version

current versions (1.x, 2.x+)

Node.js Version

all supported versions (16.x, 18.x, 20.x, 22.x+)

Database

PostgreSQL

Execution mode

main (default)

Hosting

n8n cloud