CVE-2026-77079

n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion (reassignment) path. When deleting a custom project role with a reassignment target, the code validated only that the target role existed and was project-scoped, performing no project-level authorization check. A user holding only the narrow role:manageProject global scope could delete any custom project role in use on the instance and reassign its holders (including themselves) to the built-in project:admin role, gaining full administrative control of projects they had no legitimate access to.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/n8n-io/n8n/security/advisories/GHSA-xhmh-8fgr-xqhj	Mitigation Vendor Advisory
https://www.vulncheck.com/advisories/n8n-before-authorization-bypass-via-custom-role-deletion	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:n8n:n8n::::::node.js::*
	cpe:2.3:a:n8n:n8n:2.34.0:::::node.js::

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) n8n antes de 2.34.1 y 2.33.4 contiene un bypass de autorización en la ruta de eliminación (reasignación) de roles de proyecto personalizados. Al eliminar un rol de proyecto personalizado con un objetivo de reasignación, el código validaba solo que el rol objetivo existía y tenía alcance de proyecto, sin realizar ninguna comprobación de autorización a nivel de proyecto. Un usuario que poseía solo el alcance global restringido ’role:manageProject’ podía eliminar cualquier rol de proyecto personalizado en uso en la instancia y reasignar a sus titulares (incluyéndose a sí mismos) al rol integrado ’project:admin’, obteniendo control administrativo total sobre proyectos a los que no tenían acceso legítimo.

Information

Published : 2026-08-20 12:16

Updated : 2026-10-24 13:10

NVD link : CVE-2026-77079

Mitre link : CVE-2026-77079

CVE.ORG link : CVE-2026-77079

JSON object : View

Products Affected

n8n

n8n

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-77079", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77079", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T14:29:56.466814Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "n8n-io", "product": "n8n", "versions": [{"status": "affected", "version": "2.34.0", "lessThan": "2.34.1", "versionType": "semver"}, {"status": "unaffected", "version": "2.34.1", "versionType": "semver"}], "packageURL": "pkg:npm/n8n", "defaultStatus": "unaffected"}, {"vendor": "n8n-io", "product": "n8n", "versions": [{"status": "affected", "version": "2.0.0", "lessThan": "2.33.4", "versionType": "semver"}, {"status": "unaffected", "version": "2.33.4", "versionType": "semver"}], "packageURL": "pkg:npm/n8n", "defaultStatus": "unaffected"}]}], "published": "2026-08-20T12:16:39.263", "references": [{"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-xhmh-8fgr-xqhj", "tags": ["Mitigation", "Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/n8n-before-authorization-bypass-via-custom-role-deletion", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion (reassignment) path. When deleting a custom project role with a reassignment target, the code validated only that the target role existed and was project-scoped, performing no project-level authorization check. A user holding only the narrow role:manageProject global scope could delete any custom project role in use on the instance and reassign its holders (including themselves) to the built-in project:admin role, gaining full administrative control of projects they had no legitimate access to."}, {"lang": "es", "value": "n8n antes de 2.34.1 y 2.33.4 contiene un bypass de autorizaci\u00f3n en la ruta de eliminaci\u00f3n (reasignaci\u00f3n) de roles de proyecto personalizados. Al eliminar un rol de proyecto personalizado con un objetivo de reasignaci\u00f3n, el c\u00f3digo validaba solo que el rol objetivo exist\u00eda y ten\u00eda alcance de proyecto, sin realizar ninguna comprobaci\u00f3n de autorizaci\u00f3n a nivel de proyecto. Un usuario que pose\u00eda solo el alcance global restringido \u2019role:manageProject\u2019 pod\u00eda eliminar cualquier rol de proyecto personalizado en uso en la instancia y reasignar a sus titulares (incluy\u00e9ndose a s\u00ed mismos) al rol integrado \u2019project:admin\u2019, obteniendo control administrativo total sobre proyectos a los que no ten\u00edan acceso leg\u00edtimo."}], "lastModified": "2026-10-24T13:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "B7510118-EBE0-433E-A6F3-3F5E969BD63B", "versionEndExcluding": "2.33.4"}, {"criteria": "cpe:2.3:a:n8n:n8n:2.34.0:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "8A0C7105-5801-41C3-89AA-40C2D938ECCD"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}