n8n: N8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role…
n8n
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-77079
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 20, 2026
- Source last modified
- October 24, 2026
Description
n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion (reassignment) path. When deleting a custom project role with a reassignment target, the code validated only that the target role existed and was project-scoped, performing no project-level authorization check. A user holding only the narrow role:manageProject global scope could delete any custom project role in use on the instance and reassign its holders (including themselves) to the built-in project:admin role, gaining full administrative control of projects they had no legitimate access to.
Description quoted from the NVD record.
Who is affected
n8n, a tool that connects your apps and services so routine tasks run automatically, has a flaw in the part that lets people delete custom project roles and move their members to another role. This flaw affects n8n versions before 2.34.1 and 2.33.4. A user who has only a narrow permission to manage projects could delete any custom project role in use and move its members, including themselves, to the built-in project administrator role. That would give them full administrative control of projects they should not be able to reach. This flaw is rated High.
What to do
- Find out who runs n8n for your organization: the person who installed it, or the IT provider or vendor who manages it.
- If you run n8n yourself, update it to version
2.34.1or2.33.4, the fixed versions named for this flaw. - If an IT provider or vendor runs n8n for you, send them this advisory and ask when the update will be done.
- Read the vendor advisory linked on this page for any further details about this flaw and its fix.
Analysis written from the source record as of October 24, 2026 and reviewed before publishing.