CVE-2026-103260 is an authorization bypass vulnerability affecting n8n workflow automation software. Specifically, in the Send and Wait node's Approve Within Chat mode, the system fails to verify the requester's identity or approval permissions when processing resume requests. This allows unauthenticated users to bypass approval controls and advance executions that are normally guarded, potentially triggering sensitive or restricted actions within workflows. The vulnerability affects n8n versions prior to 2.39.6 and versions 2.40.0 prior to 2.40.1.

An attacker without authentication can bypass approval mechanisms in the affected n8n versions, allowing them to resume waiting executions and trigger guarded workflow actions. This could lead to unauthorized execution of automated tasks that require approval, potentially impacting workflow integrity and security. The CVSS 4.0 base score is 6.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited impact on confidentiality and integrity.

Upgrade n8n to version 2.39.6 or later, or to version 2.40.1 or later, where this approval bypass vulnerability has been fixed. No other mitigations are indicated. Patch status is confirmed by the affected version ranges provided.