n8n CVE-2026-77079

Exploitation requires a valid, authenticated n8n user account that has been explicitly granted the role:manageProject global scope - this is not a default permission assigned to new users and must be deliberately provisioned. The target n8n instance must have at least one custom project role defined and assigned to users, as the vulnerability lives in the custom role deletion-with-reassignment path; instances with no custom project roles configured are not exposed to this specific code path. The attacker specifies the built-in project:admin role as the reassignment target in the deletion request. Exploitation is bounded to n8n versions before 2.33.4 and 2.34.1. No non-default network configuration is required beyond standard API access to the n8n instance.

The CVSS 4.0 score of 7.4 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H positions this as a high-severity, network-exploitable issue. The AT:P (attack requirements present) metric correctly captures that exploitation is gated behind possession of the role:manageProject global scope - a non-default, explicitly-granted permission - which meaningfully limits the exposed population. PR:L confirms authentication is required. The subsequent-system impact metrics SC:H/SI:H/SA:H reflect the real consequence: an attacker can pivot from a narrow administrative role into full project admin across all projects on the instance, a near-total authorization collapse for multi-tenant or multi-team n8n deployments. No CISA KEV listing and no public POC code exist at time of analysis, so this is not known to be actively exploited. The combination of a specific permission prerequisite and no public exploit makes this a high priority for organizations with multi-user n8n instances where role:manageProject is granted to non-admin users, and lower priority for single-user or tightly-controlled deployments. No conflicting signals exist between the CVSS vector and the description.

An attacker with a legitimate n8n account that has been granted the role:manageProject global scope - for example, a delegated project manager with no intended admin access - sends a crafted API request to delete a custom project role, supplying the built-in project:admin role as the reassignment target. The server validates that project:admin is a valid project-scoped role but skips the check verifying the requester's authority over the affected project memberships. All holders of the deleted role, including the attacker themselves, are silently promoted to project:admin across the instance, granting them full control over projects and workflows they had no legitimate access to.