Understanding the n8n Authorization Vulnerability (CVE-2026-59253)
A security flaw has been found in n8n, a popular workflow automation tool. This vulnerability, identified as CVE-2026-59253, allows certain authenticated users to improperly assign workflows to folders in projects they shouldn’t have access to. While sensitive project data remains untouched, this issue can disrupt how projects are organized within n8n, affecting the logical order of your folders.
CVE Details
Product: n8n
Published: July 8, 2026
Severity: Medium
Status: Analyzed
Affected Products
This vulnerability impacts n8n versions prior to 2.28.0. If you are running an older version, your system could be at risk. The issue specifically targets instances of n8n that utilize multi-project and folder support.
Current Status
The vulnerability has been thoroughly analyzed by security researchers. Fortunately, a fix is available, and users are strongly advised to update their n8n installations to the patched version immediately.
Severity Level
The vulnerability is rated as Medium severity, with a CVSS score of 5.3. This score reflects that while the flaw requires an authenticated user to exploit, and does not directly expose sensitive data, it can lead to integrity violations within project structures. Essentially, unauthorized organization of workflows can occur, impacting how administrators manage their projects.
Possible Solutions
The most effective way to protect your n8n instance from this improper authorization vulnerability is to update to a patched version.
- Upgrade: The issue has been addressed in n8n version 2.28.0 and later. It is highly recommended to upgrade your n8n installation to at least this version.
If an immediate upgrade is not feasible, consider these temporary mitigation steps:
- Restrict Permissions: Limit project membership and the ability to create workflows only to users who are fully trusted. This is a short-term measure and does not eliminate the root cause of the vulnerability.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-2xgm-wc4g-5jvg
https://www.vulncheck.com/advisories/n8n-improper-authorization-in-workflow-assignment-to-folders
