CVE-2026-77079

n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion (reassignment) path.

N8N

n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion (reassignment) path. When deleting a custom project role with a reassignment target, the code validated only that the target role existed and was project-scoped, performing no project-level authorization check. A user holding only the narrow role:manageProject global scope could delete any custom project role in use on the instance and reassign its holders (including themselves)…

20. Aug 2026

Ausgewertete Quellen

• Hinweis
  https://www.vulncheck.com/advisories/n8n-before-authorization-bypass-via-custom-role-deletion
• NVD
  CVE-2026-77079
• GitHub
  https://github.com/n8n-io/n8n/security/advisories/GHSA-xhmh-8fgr-xqhj