Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-118649

n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner project in memory by that ID, so a crafted ID such as __proto__ makes the Data Table project check match every project. An authenticated member who can create and run workflows can list, read, modify, and delete Data Table rows in all projects of the instance.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n8n-io n8n

Default version status: unaffected

  • 2.44.0 to < 2.44.1affected
  • 2.44.1unaffected
pkg:npm/n8n

n8n-io n8n

Default version status: unaffected

  • 0 to < 2.43.5affected
  • 2.43.5unaffected
pkg:npm/n8n

References