CVE-2026-77079: Authorization Bypass Through User-Controlled Key in n8n-io n8n

This vulnerability in n8n allows a user with limited global permissions (role:manageProject) to bypass authorization controls during the deletion and reassignment of custom project roles. The code only verifies that the reassignment target role exists and is project-scoped but does not verify if the user has authorization for the specific project. Exploiting this flaw enables privilege escalation to project:admin, granting full administrative access to projects without legitimate rights.

An attacker with the role:manageProject global scope can escalate privileges by deleting any custom project role and reassigning users (including themselves) to the project:admin role. This results in unauthorized full administrative control over projects, potentially compromising project integrity and confidentiality.

Upgrade n8n to version 2.34.1 or later, or to 2.33.4 or later, where this authorization bypass vulnerability has been fixed. No other mitigation is indicated by the vendor advisory.