N8n EUVD-2026-15944

Requires n8n versions before 2.4.0 or 1.121.0 with LDAP authentication enabled. Attacker must be an authenticated LDAP user who can control their own LDAP email attribute, setting it to match a target user's email (including administrators) to hijack their account upon next login.

The real-world risk is moderate to high for organizations using LDAP authentication with n8n, but limited in overall scope. The CVSS 4.0 score of 8.8 reflects network-based attack vector (AV:N), low complexity (AC:L), and high confidentiality and integrity impact (VC:H, VI:H), but requires low privileges (PR:L) and presents attack complexity prerequisites (AT:P) since LDAP must be configured and the attacker needs control over their LDAP email attribute. The vulnerability requires non-default LDAP configuration, significantly reducing the attack surface compared to default installations. Without EPSS data or KEV status indicating active exploitation, and given the requirement for authenticated LDAP access and directory write permissions, this represents a serious but targeted risk primarily for organizations using LDAP with permissive directory configurations. The persistence of the account takeover after email reversion elevates the severity for affected deployments.

An authenticated LDAP user with permission to modify their own directory email attribute changes it to match an administrator's email address (e.g., admin@company.com). Upon their next login to n8n, the platform automatically links their LDAP identity to the administrator account, granting them full administrative access. The attacker then reverts their LDAP email to its original value, but retains permanent access to the compromised administrator account through the persistent linkage.