CVE-2026-77079
Received Received - Intake

Authorization Bypass in n8n Custom Project Role Deletion

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: VulnCheck

Description
n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion (reassignment) path. When deleting a custom project role with a reassignment target, the code validated only that the target role existed and was project-scoped, performing no project-level authorization check. A user holding only the narrow role:manageProject global scope could delete any custom project role in use on the instance and reassign its holders (including themselves) to the built-in project:admin role, gaining full administrative control of projects they had no legitimate access to.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-77079
EUVD
EUVD-2026-63267

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
n8n n8n to 2.33.4|end_excluding=2.34.1 (exc)
n8n n8n to 2.34.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in n8n versions before 2.34.1 and 2.33.4. When deleting a custom project role with a reassignment target, the system only checks if the target role exists and is project-scoped. It fails to verify project-level authorization. This allows a user with the global role:manageProject scope to delete any custom project role and reassign its holders, including themselves, to the built-in project:admin role. This grants full administrative control over projects they have no legitimate access to.

Detection Guidance

To detect this vulnerability, check the n8n version installed on your system. Run commands like 'n8n --version' or check the version in the n8n interface. If your version is below 2.33.4 or 2.34.1, the system is vulnerable.

Impact Analysis

An attacker with the role:manageProject scope could exploit this to gain full administrative control over projects they are not authorized to access. This could lead to unauthorized data access, modification, or deletion, and potential compromise of the entire n8n instance. The impact includes high confidentiality, integrity, and availability risks.

Compliance Impact

This vulnerability could lead to unauthorized access and manipulation of sensitive data, violating compliance requirements such as GDPR (data protection) and HIPAA (health information privacy). Unauthorized administrative access may result in data breaches, non-compliance with access control policies, and potential legal or regulatory penalties.

Mitigation Strategies
  • Upgrade n8n to version 2.33.4 or 2.34.1 or later immediately to patch the vulnerability.
  • Audit and revoke any global roles with the 'role:manageProject' scope from users who do not require them.
  • Disable the CUSTOM_ROLES feature if it is not actively used in your n8n instance.
  • Restrict instance access to only trusted users to minimize exposure to potential attackers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77079. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart