CVE-2026-59253: n8n Improper Authorization in Workflow Folder Assignment

Technical summary

CVE-2026-59253 is an improper authorization vulnerability (CWE-639) in n8n versions prior to 2.28.0. The flaw exists in workflow assignment logic during creation or modification. When a user supplies a crafted payload specifying a target folder, the application fails to validate that the folder belongs to a project the user is authorized to access. By bypassing these authorization checks, an attacker can place workflows into arbitrary project folders, compromising the logical separation of multi-tenant or multi-project deployments. The vulnerability requires prior authentication and does not enable unauthorized data reads.

Business impact

For organizations using n8n to manage multiple projects or teams, this vulnerability breaks the security model that isolates project workspaces. An authenticated user—whether an insider or someone with compromised credentials—can pollute or disrupt folder structures in projects they do not own, leading to confusion, accidental execution of workflows in unintended contexts, and potential compliance violations if audit trails become unclear. In shared or SaaS environments, this is particularly damaging because it erodes trust in project isolation.

Affected systems

n8n versions before 2.28.0 are vulnerable. Organizations running n8n self-hosted or cloud deployments should verify their installed version immediately. The vulnerability affects all deployments where multiple projects or teams share the same n8n instance and rely on authorization boundaries.

Exploitability

Exploitation requires an authenticated n8n user account with the ability to create or edit workflows. No interaction from other users is needed, and the attack is straightforward: supply a folder ID from a target project in the workflow creation or modification request. Network access is required but is typically available to any authenticated user. The CVSS score of 5.0 (Medium) reflects that while exploitability is relatively easy, the impact is limited to integrity of folder organization, not confidentiality or availability.

Remediation

Upgrade to n8n version 2.28.0 or later. This release includes authorization validation that ensures a user can only assign workflows to folders within projects they are authorized to access. After patching, review any audit logs for suspicious workflow placements in unowned projects during the vulnerability window.

Patch guidance

Update n8n to version 2.28.0 or later. Consult the official n8n release notes and security advisory for deployment-specific guidance, as patch procedures may differ between self-hosted and cloud-managed installations. Verify the patch in a non-production environment first if your deployment is large or complex. No rollback issues have been reported, but standard change management practices apply.

Detection guidance

Look for workflow creation or modification API calls that specify folder IDs outside the user's assigned projects. Monitor audit logs for workflows appearing in unexpected project folders, particularly if the creating user does not have documented access to that project. Check for patterns of users rapidly probing different project IDs to identify folder assignments. Network-based detection is difficult without logging the request payloads; focus on application-level audit logs and compare workflow ownership against user permissions.

Why prioritize this

Although the CVSS score is Medium (5.0), this vulnerability should be prioritized for patching in multi-tenant or multi-project deployments. The issue directly undermines logical security boundaries and can enable subtle but serious privilege escalation. Organizations with strict project isolation requirements, compliance mandates, or shared workflows across teams should treat this as higher priority. Single-project or single-team n8n deployments face lower risk.

Risk score, explained

CVSS 3.1 score of 5.0 (Medium) is assigned because: Attack Vector is Network (remotely exploitable), Access Complexity is Low (no special conditions needed), Privileges Required is Low (valid user account), User Interaction is None (automatic exploitation), Scope is Changed (affects other projects), Confidentiality is None (no data exposure), Integrity is Low (folder assignment is altered, not data corruption), and Availability is None (system remains operational). The cross-scope impact justifies Medium severity, but lack of data exposure or availability impact prevents a higher score.

Frequently asked questions