EUVD-2026-70408
GHSA-rvc3-jcfp-627r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid n8n account with insights scope
-
DeliveryIdentify or brute-enumerate projectId values
-
ExploitIssue Insights API requests with arbitrary projectId
-
ExecutionReceive foreign-project workflow names and execution stats
-
ImpactMap organizational workflow structure across instance
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Exploitation requires a valid n8n account with the insights scope assigned on the target instance, and network-level access to the Insights API routes (AV:N). The attacker must be able to reach the n8n API over HTTPS. The flaw is limited exclusively to Insights API routes - other API surfaces enforce project authorization separately. The primary limiting factor is the requirement for a legitimately provisioned, authenticated insights-scoped session; unauthenticated users and authenticated users without the insights scope cannot exploit this. Risk is highest in multi-tenant deployments where insights access is broadly granted to non-trusted or non-vetted users. |
| Impact | The CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N with subsequent-system C:L) is consistent with the actual impact: only project-level metadata (workflow names, execution statistics) is reachable, not secrets, credentials, or workflow payloads. Attack complexity is low once the attacker holds a valid insights-scoped account. Real-world risk is concentrated in multi-tenant or shared n8n deployments where multiple organizations or teams share a single instance with non-trusted user populations; single-tenant self-hosted deployments with a fully trusted user base face negligible practical risk. No KEV listing exists and no POC is publicly available at time of analysis. EPSS data is absent from the input. The 'Authentication Bypass' tag in the source metadata is a mislabel - authentication is enforced (PR:L); the gap is exclusively in per-project authorization. |
| Exploit ScenarioDerived | An authenticated n8n user with an insights-scoped API token enumerates project IDs - which may be sequential UUIDs discoverable through the application UI or prior legitimate API responses - then crafts GET requests to the Insights API substituting arbitrary |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 03, 2026
Workflow names and execution statistics from arbitrary projects are exposed in n8n versions before 2.36.2 due to missing per-project authorization in the Insights API. Any authenticated user holding an insights-scoped credential can supply arbitrary projectId parameters to Insights API routes and retrieve analytics data from projects they have no membership in - a classic IDOR (Insecure Direct Object Reference) pattern. No public exploit code has been identified and the CVSS 4.0 score of 5.3 reflects the limited disclosure scope (execution metadata only, no credential or workflow-payload exposure).
RemediationAI
Upgrade n8n to version 2.36.2 or later, which introduces per-project membership checks on all Insights API routes per the vendor advisory at https://github.com/n8n-io/n8n/security/advisories/GHSA-jmmj-93rg-6j39. If an immediate upgrade is not feasible, restrict access to the Insights API endpoints at the reverse-proxy or network layer (e.g., block /api/v1/insights/* routes) for all but trusted internal IP ranges - note this disables insights dashboards for all users as a side effect. Additionally, audit the user base to ensure insights-scoped credentials are issued only to users who legitimately require cross-project visibility.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
n8n is a self-hostable, open-source workflow automation platform (CPE: cpe:2.3:a:n8n-io:n8n). Its Insights API surfaces analytics endpoints that return per-project workflow execution counts and statistics. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the application correctly authenticates the caller and verifies possession of an insights scope, but fails to cross-check that the caller belongs to the project identified by the caller-supplied projectId parameter. This omission enables horizontal privilege escalation across project namespaces - a server-side enforcement gap, not a client-side or transport-layer issue.
Know when N8n gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
Network-accessible IDOR requiring low-privilege auth (PR:L); no impact on the vulnerable system itself; subsequent-system confidentiality limited to project metadata (SC:L).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that allows authenticated users with insights scopes to access workflow names and execution statistics across projects. Attackers can supply arbitrary projectId parameters to retrieve sensitive project and workflow information from projects they have no membership in.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through craft
Authenticated users who can create or modify an n8n workflow can achieve remote code execution on the n8n host by abusin
A prototype pollution vulnerability in the XML and GSuiteAdmin nodes of n8n workflow automation platform allows authenti
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit
n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function w
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP
The n8n package 0.218.0 for Node.js allows Escalation of Privileges. Rated high severity (CVSS 8.8), this vulnerability
SQL injection in n8n's Data Table Get node allows authenticated users with workflow modification permissions to execute
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox
Exploit-DB