Skip to content
← Vulnerability catalog
OFFICIAL CVE RECORD5.3 Medium

CVE-2026-56775

n8n - Incorrect OAuth Scope Validation in Evaluation Test Runs Endpoints

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization vulnerability in three mutating evaluation test-run endpoints that authorize state-changing actions using the workflow:read scope instead of the action-appropriate workflow:execute scope. On instances using Advanced Permissions (Enterprise/Cloud) with projects and viewer roles, an authenticated user with the project:viewer role can start new evaluation test runs, cancel in-flight runs, and delete run records for workflows they only have read access to.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n8n n8n

Default version status: unaffected

  • 0 to < 1.123.55affected
  • 1.123.55unaffected
pkg:npm/n8n

n8n n8n

Default version status: unaffected

  • 2.26.0 to < 2.26.2affected
  • 2.26.2unaffected
pkg:npm/n8n

n8n n8n

Default version status: unaffected

  • 2.0.0-rc.0 to < 2.25.7affected
  • 2.25.7unaffected
pkg:npm/n8n

References