Home

Description

n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization vulnerability in three mutating evaluation test-run endpoints that authorize state-changing actions using the workflow:read scope instead of the action-appropriate workflow:execute scope. On instances using Advanced Permissions (Enterprise/Cloud) with projects and viewer roles, an authenticated user with the project:viewer role can start new evaluation test runs, cancel in-flight runs, and delete run records for workflows they only have read access to.

PUBLISHED Reserved 2026-06-23 | Published 2026-07-08 | Updated 2026-07-08 | Assigner VulnCheck




MEDIUM: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
MEDIUM: 5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Problem types

Incorrect Authorization

Product status

Default status
unaffected

Any version before 1.123.55
affected

1.123.55 (semver)
unaffected

Default status
unaffected

Any version before 2.26.2
affected

2.26.2 (semver)
unaffected

Default status
unaffected

Any version before 2.25.7
affected

2.25.7 (semver)
unaffected

Credits

YLChen-007 reporter

References

github.com/...io/n8n/security/advisories/GHSA-664h-gpgq-h6xx (GitHub Security Advisory (GHSA-664h-gpgq-h6xx)) vendor-advisory

www.vulncheck.com/...ation-in-evaluation-test-runs-endpoints (VulnCheck Advisory: n8n - Incorrect OAuth Scope Validation in Evaluation Test Runs Endpoints) third-party-advisory

cve.org (CVE-2026-56775)

nvd.nist.gov (CVE-2026-56775)

Download JSON