A privilege escalation vulnerability exists in n8n's Enterprise SSO instance-role provisioning for versions prior to 1.123.64, 2.29.8, and 2.30.1. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role, unlike the token-exchange identity path which rejects it. An attacker who can control the instance-role claim value issued by the IdP and with instance-role provisioning enabled can be provisioned as the instance owner, gaining full administrative privileges. Exploitation requires specific configuration: Enterprise SSO enabled and instance-role provisioning enabled via the environment variable N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE, which is disabled by default.

An attacker who successfully exploits this vulnerability can escalate privileges to become the instance owner, gaining full administrative control over the n8n instance. This includes control over workflows, credentials, users, and instance configuration, potentially compromising the entire system's integrity and confidentiality.

A fix is available in n8n versions 1.123.64, 2.29.8, and 2.30.1 and later. Users should upgrade to these or later versions to remediate the vulnerability. Additionally, instance-role provisioning is disabled by default; ensure it remains disabled if not required. Review Enterprise SSO configuration to restrict control over instance-role claim values issued by the IdP. Since this advisory is a duplicate and withdrawn, refer to the original advisory GHSA-35q8-9mj6-wjmf for the authoritative remediation guidance.