Understanding the n8n Authorization Flaw
A security vulnerability, identified as CVE-2026-56775, has been discovered in n8n, a popular workflow automation tool. This issue specifically affects Enterprise and Cloud instances that use advanced permissions, projects, and viewer roles. Simply put, an authenticated user who only has “read” access to a workflow could perform actions that should require “execute” permissions. This means they could start, stop, or delete evaluation test runs for workflows they were only supposed to be able to view.
CVE Details
The vulnerability impacts n8n, a workflow automation platform. It was officially published on July 8, 2026, and is currently under “Analyzed” status. This flaw has been assigned a Medium severity rating.
Affected Products
This authorization vulnerability affects specific versions of n8n. Instances of n8n Enterprise and Cloud using Advanced Permissions with projects and viewer roles are vulnerable if running:
- n8n versions before 1.123.55
- n8n versions before 2.25.7
- n8n versions before 2.26.2
Current Status
The vulnerability CVE-2026-56775 is currently in an “Analyzed” status. This means the details of the vulnerability have been fully investigated and understood.
Severity Level
This vulnerability is rated as Medium Severity with a CVSS score of 5.4. A Medium severity rating indicates that while an exploit is possible, it typically requires specific conditions or existing privileges. In this case, an attacker needs to be an authenticated user with a specific viewer role within a project to manipulate workflow test runs. Although it doesn’t lead to immediate data theft or server shutdown, it allows unauthorized modification of workflow execution, which can disrupt operations or lead to unintended consequences.
Possible Solutions
The good news is that patches are available to address this vulnerability. Users are strongly advised to upgrade their n8n instances to one of the following versions or later:
- n8n 1.123.55 or later
- n8n 2.25.7 or later
- n8n 2.26.2 or later
If an immediate upgrade isn’t feasible, some temporary workarounds can help reduce the risk, though they do not fully eliminate it:
- Restrict project membership: Ensure that only fully trusted users are members of projects, especially those containing sensitive workflows.
- Limit viewer access: Avoid granting viewer access to projects that contain critical or sensitive workflows until your instance can be updated.
These mitigations should only be considered short-term measures until the recommended patches can be applied.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-664h-gpgq-h6xx
https://www.vulncheck.com/advisories/n8n-incorrect-oauth-scope-validation-in-evaluation-test-runs-endpoints
