Is there a patch available for CVE-2026-56775?

Yes, a patch is available for CVE-2026-56775. Update the affected software to the latest version immediately.

n8n CVE-2026-56775

Q: What is the CVSS score of CVE-2026-56775?

CVE-2026-56775 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-42262 MEDIUM

Incorrect Authorization (CWE-863)

2026-07-08 disclosure@vulncheck.com

GHSA-w79j-mf7m-gfpm

Authentication Bypass N8n

5.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.2 MEDIUM

PR:L for required viewer authentication; AC:H because exploitation is gated on Enterprise/Cloud Advanced Permissions with projects and viewer roles enabled.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 15:12 vuln.today

Patch available

Jul 08, 2026 - 15:01 EUVD

DescriptionCVE.org

n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization vulnerability in three mutating evaluation test-run endpoints that authorize state-changing actions using the workflow:read scope instead of the action-appropriate workflow:execute scope. On instances using Advanced Permissions (Enterprise/Cloud) with projects and viewer roles, an authenticated user with the project:viewer role can start new evaluation test runs, cancel in-flight runs, and delete run records for workflows they only have read access to.

AnalysisAI

Incorrect authorization in n8n's evaluation test-run API endpoints allows authenticated project viewers to perform state-changing operations reserved for users with execute permissions. On Enterprise and Cloud deployments running Advanced Permissions with projects and viewer roles configured, an authenticated project:viewer can start new evaluation test runs, cancel in-flight runs, and delete run records for workflows they have only read access to - bypassing the intended workflow:execute scope gate. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS 4.0 score of 5.3 (PR:L) reflects the authenticated, low-complexity nature of the flaw.

Technical ContextAI

n8n is a node-based workflow automation platform offering both self-hosted and cloud-managed deployments. Its Enterprise and Cloud tiers introduce an Advanced Permissions system that partitions workflows into projects and assigns granular roles (e.g., project:viewer) with OAuth-style scope tokens - including workflow:read and workflow:execute. The vulnerability (CWE-863: Incorrect Authorization) arises because three mutating REST endpoints in the evaluation test-run feature incorrectly gate access using the workflow:read scope rather than the action-appropriate workflow:execute scope. This means the server-side authorization check passes for any user who can read the workflow, rather than requiring the execute privilege that state-changing operations demand. Affected versions span both the 1.x and 2.x release lines: all n8n releases prior to 1.123.55, 2.25.7, and 2.26.2.

RemediationAI

The primary remediation is to upgrade n8n to a patched release: version 1.123.55 or later on the 1.x branch, version 2.25.7 or later on the 2.25.x branch, or version 2.26.2 or later on the 2.26.x branch. Full details are in the vendor security advisory at https://github.com/n8n-io/n8n/security/advisories/GHSA-664h-gpgq-h6xx and the VulnCheck advisory at https://www.vulncheck.com/advisories/n8n-incorrect-oauth-scope-validation-in-evaluation-test-runs-endpoints. If immediate patching is not feasible, organizations can reduce exposure by auditing and tightening project:viewer role assignments - removing viewer roles from accounts that do not require them reduces the pool of principals who can trigger the mischecked endpoints. Note that disabling the evaluation test-run feature entirely (if operationally viable) would eliminate the attack surface for these three specific endpoints. There is no known workaround that preserves viewer access while fully blocking the misrouted scope check without patching.