Authorization Bypass in n8n Public API Execution Retry

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-56778 is an authorization bypass vulnerability in n8n versions before 2.25.7 and 2.26.x before 2.26.2. The issue occurs in the Public API execution retry endpoint, which incorrectly authorizes access using the workflow:read scope instead of the workflow:execute scope.

This means that an authenticated user who only has read-only access to a shared workflow can use the Public API to retry executions of that workflow, bypassing the intended permission boundary between read and execute access.

The vulnerability affects instances where workflows are shared with other users or across projects.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authenticated user with only read access to a workflow to perform execution retries, which they should not be authorized to do.

As a result, unauthorized actions can be performed on workflows, potentially leading to unintended workflow executions.

This can undermine the security model by bypassing permission boundaries, possibly causing operational issues or exposing sensitive workflow processes to unauthorized manipulation.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, it is recommended to upgrade n8n to versions 2.25.7 or 2.26.2 or later, where the issue is patched.

As temporary mitigations before upgrading, restrict workflow sharing to trusted users only and limit network access to the Public API endpoint to reduce exposure.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves unauthorized use of the Public API execution retry endpoint in n8n, where the workflow:read scope is incorrectly used instead of workflow:execute. Detection can focus on monitoring API calls to the execution retry endpoint to identify if users with only read permissions are attempting or succeeding in retrying workflow executions.

Suggested detection steps include:

• Monitor network traffic or API logs for calls to the Public API execution retry endpoint.
• Check if these calls are made by users with only workflow:read permissions.
• Look for unusual retry execution activity from read-only users.

Specific commands depend on your environment and logging setup, but examples include:

• Using grep or similar tools on API logs: grep -i 'execution retry' /path/to/n8n/api/logs
• Using network monitoring tools like tcpdump or Wireshark to filter HTTP requests to the retry endpoint.
• Querying n8n logs or database for retry execution requests initiated by users with read-only roles.

Useful 0 Not Useful 0