n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects (CVE-2026-59253)
An authorization vulnerability in n8n prior to version 2.28.0 allows authenticated users with workflow creation permissions in one project to associate newly created workflows with folders in other projects they do not have access to. This does not expose data or change folder ownership but causes a logical integrity violation in the folder structure at the database level. The issue affects instances with multi-project and folder support enabled.
AI Analysis
Technical Summary
CVE-2026-59253 is an improper authorization vulnerability in n8n that permits an authenticated user with permission to create workflows in one project to bypass project and folder authorization boundaries during workflow creation. By crafting a specific request payload, the user can link a new workflow to a folder in a different project without access rights. The workflow remains in the attacker's project and is not visible to members of the target project. The vulnerability results in a logical integrity violation of the folder structure in the database but does not expose data or alter folder ownership. This issue affects n8n instances with multi-project and folder support enabled and is fixed in version 2.28.0.
Potential Impact
The impact is limited to a logical integrity violation in the folder structure of projects at the database level. No data from the target project is exposed, folder ownership is not changed, and the workflow remains in the attacker's project. There is no direct confidentiality, integrity, or availability impact on the target project's data or users beyond this structural inconsistency.
Mitigation Recommendations
Upgrade n8n to version 2.28.0 or later to remediate this vulnerability. If immediate upgrade is not possible, restrict project membership and workflow creation permissions to fully trusted users only as a temporary mitigation. This workaround does not fully eliminate the risk and should only be used short-term until the official fix is applied.
n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects (CVE-2026-59253)
Description
An authorization vulnerability in n8n prior to version 2.28.0 allows authenticated users with workflow creation permissions in one project to associate newly created workflows with folders in other projects they do not have access to. This does not expose data or change folder ownership but causes a logical integrity violation in the folder structure at the database level. The issue affects instances with multi-project and folder support enabled.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-59253 is an improper authorization vulnerability in n8n that permits an authenticated user with permission to create workflows in one project to bypass project and folder authorization boundaries during workflow creation. By crafting a specific request payload, the user can link a new workflow to a folder in a different project without access rights. The workflow remains in the attacker's project and is not visible to members of the target project. The vulnerability results in a logical integrity violation of the folder structure in the database but does not expose data or alter folder ownership. This issue affects n8n instances with multi-project and folder support enabled and is fixed in version 2.28.0.
Potential Impact
The impact is limited to a logical integrity violation in the folder structure of projects at the database level. No data from the target project is exposed, folder ownership is not changed, and the workflow remains in the attacker's project. There is no direct confidentiality, integrity, or availability impact on the target project's data or users beyond this structural inconsistency.
Mitigation Recommendations
Upgrade n8n to version 2.28.0 or later to remediate this vulnerability. If immediate upgrade is not possible, restrict project membership and workflow creation permissions to fully trusted users only as a temporary mitigation. This workaround does not fully eliminate the risk and should only be used short-term until the official fix is applied.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-2xgm-wc4g-5jvg
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-59253"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6a6150c89c2644c7f8d9fde8
Added to database: 07/22/2026, 23:22:48 UTC
Last enriched: 07/22/2026, 23:25:31 UTC
Last updated: 07/23/2026, 02:51:54 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.