CVE-2026-77079: Authorization Bypass Through User-Controlled Key in n8n-io n8n
n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion (reassignment) path. When deleting a custom project role with a reassignment target, the code validated only that the target role existed and was project-scoped, performing no project-level authorization check. A user holding only the narrow role:manageProject global scope could delete any custom project role in use on the instance and reassign its holders (including themselves) to the built-in project:admin role, gaining full administrative control of projects they had no legitimate access to.
AI Analysis
Technical Summary
The vulnerability exists in n8n's handling of custom project role deletion with reassignment. The code only verifies that the reassignment target role exists and is project-scoped but does not verify if the user has authorization for the specific project. Consequently, a user with the narrow global role:manageProject permission can delete any custom project role and reassign its holders, including themselves, to the built-in project:admin role. This results in unauthorized elevation of privileges to full project admin rights on projects where the user should not have access.
Potential Impact
An attacker with limited global permissions can escalate privileges to full administrative control over any project by deleting custom project roles and reassigning users to the project:admin role. This compromises project-level access controls and can lead to unauthorized project management and data access.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict assignment of the role:manageProject global permission to trusted users only to reduce risk.
CVE-2026-77079: Authorization Bypass Through User-Controlled Key in n8n-io n8n
Description
n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion (reassignment) path. When deleting a custom project role with a reassignment target, the code validated only that the target role existed and was project-scoped, performing no project-level authorization check. A user holding only the narrow role:manageProject global scope could delete any custom project role in use on the instance and reassign its holders (including themselves) to the built-in project:admin role, gaining full administrative control of projects they had no legitimate access to.
CVSS v4.0
Score 7.4high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists in n8n's handling of custom project role deletion with reassignment. The code only verifies that the reassignment target role exists and is project-scoped but does not verify if the user has authorization for the specific project. Consequently, a user with the narrow global role:manageProject permission can delete any custom project role and reassign its holders, including themselves, to the built-in project:admin role. This results in unauthorized elevation of privileges to full project admin rights on projects where the user should not have access.
Potential Impact
An attacker with limited global permissions can escalate privileges to full administrative control over any project by deleting custom project roles and reassigning users to the project:admin role. This compromises project-level access controls and can lead to unauthorized project management and data access.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict assignment of the role:manageProject global permission to trusted users only to reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-20T10:55:09.093Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a86e708acd9273b498befce
Added to database: 08/20/2026, 11:37:44 UTC
Last enriched: 08/20/2026, 11:52:30 UTC
Last updated: 08/20/2026, 21:03:54 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.