CVE-2026-56775: n8n Authorization Bypass in Test-Run Endpoints

Technical summary

Three mutating evaluation test-run endpoints in n8n fail to enforce the correct authorization scope. The endpoints authorize state-changing operations using the workflow:read scope instead of the required workflow:execute scope. In deployments leveraging Advanced Permissions with project isolation and role-based access control, users assigned the project:viewer role can invoke these endpoints to instantiate new evaluation test runs, terminate in-flight test executions, and remove test run records—actions that should be restricted to users with explicit execute permissions on the target workflow. The vulnerability is classified as CWE-863 (Incorrect Authorization).

Business impact

Organizations relying on n8n's role-based access controls to segregate workflow execution rights may experience unauthorized disruption of production test runs, data loss through deletion of audit-relevant run records, and potential workflow exposure to users who should lack execution privileges. In multi-tenant or departmental deployment scenarios, viewer-role users could interfere with test pipelines belonging to other teams. The impact is mitigated somewhat by the requirement for Advanced Permissions (Enterprise/Cloud SKUs) and prior authentication; however, this is a direct bypass of intended access controls.

Affected systems

n8n versions prior to 1.123.55 (legacy), 2.25.7, and 2.26.2 (current branches) running in Enterprise or Cloud editions with Advanced Permissions enabled and project-based role assignment. Self-hosted open-source deployments without Advanced Permissions are not affected. The vulnerability requires an authenticated user account with project:viewer role assignment within an organization using this feature set.

Exploitability

Exploitation is straightforward for any authenticated user with project:viewer role—no additional bypass techniques or user interaction required. An attacker need only craft HTTP requests to the three affected endpoints with appropriate workflow identifiers. The low complexity, requirement for a valid user account, and absence of user interaction place this in the CVSS MEDIUM range (5.4). The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog. No public proof-of-concept or active exploitation has been reported as of the publication date.

Remediation

Upgrade to patched versions: n8n 1.123.55 or later (legacy track), 2.25.7 or later, or 2.26.2 or later. Patched releases correct the authorization scope check on affected test-run endpoints to enforce workflow:execute permission. After upgrade, verify that role-based access controls are functioning as intended by testing viewer-role user attempts to start, cancel, or delete test runs—these operations should now be denied.

Patch guidance

Consult n8n's official release notes and security advisories for your deployment channel (self-hosted, Enterprise, or Cloud). Apply the appropriate patched version for your current release branch. For Cloud-hosted instances, patches may be applied automatically; verify your instance version after the published patch date. For self-hosted deployments, schedule a maintenance window and follow n8n's deployment procedures. No data migration or configuration changes are required post-patch.

Detection guidance

Monitor audit logs for project:viewer role accounts invoking test-run management endpoints (start, cancel, delete operations) on workflows where they possess only read permissions. Search for HTTP POST/DELETE requests from low-privilege user accounts to endpoints associated with evaluation test-run lifecycle management. Correlate viewer-role accounts with unusual test-run activity patterns, particularly deletions or cancellations by users outside the workflow's owning team. In n8n audit logs, look for state-changing actions attributed to users lacking workflow:execute scope assignments.

Why prioritize this

While the CVSS score is MEDIUM (5.4), prioritization depends on your deployment model and multi-tenancy posture. If you operate n8n Enterprise or Cloud with project-based role segregation and multiple teams sharing the instance, this vulnerability is HIGH priority because it directly undermines your access control model. If you run open-source n8n or do not use Advanced Permissions, this is LOW priority. If you have strict role separation and audit requirements, treat this as HIGH priority despite the CVSS rating, as it represents a control bypass.

Risk score, explained

The CVSS 3.1 score of 5.4 (MEDIUM) reflects the requirement for prior authentication (PR:L), network-only attack vector (AV:N), low complexity (AC:L), and the dual impact of integrity (deletion of records, I:L) and availability (workflow disruption through run cancellation, A:L) without confidentiality breach. The score does not weight the severity of access control circumvention in regulated or multi-tenant environments; teams using Advanced Permissions for compliance or governance should evaluate this as a control-bypass risk above the base CVSS.

Frequently asked questions