CVE-2026-56778
Full vulnerability record from the local CVENow database.
Description
n8n before 2.25.7 and 2.26.x before 2.26.2 contains an authorization bypass in the Public API execution retry endpoint, which authorizes access using the workflow:read scope instead of workflow:execute. An authenticated user with read-only access to a shared workflow can use the Public API to retry executions of that workflow, bypassing the intended permission boundary between read and execute access. This affects instances where workflows are shared with other users or across projects.
Severity
MEDIUM
CVSS score
5.3
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-07-08 14:17:17.683000
Last modified
2026-10-29 19:17:23.480000
View original CVE JSON
{
"id": "CVE-2026-56778",
"sourceIdentifier": "[email protected]",
"published": "2026-07-08T14:17:17.683",
"lastModified": "2026-10-29T19:17:23.480",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "n8n before 2.25.7 and 2.26.x before 2.26.2 contains an authorization bypass in the Public API execution retry endpoint, which authorizes access using the workflow:read scope instead of workflow:execute. An authenticated user with read-only access to a shared workflow can use the Public API to retry executions of that workflow, bypassing the intended permission boundary between read and execute access. This affects instances where workflows are shared with other users or across projects."
},
{
"lang": "es",
"value": "n8n anterior a 2.25.7 y 2.26.x anterior a 2.26.2 contiene un bypass de autorización en el endpoint de reintento de ejecución de la API Pública, que autoriza el acceso usando el ámbito workflow:read en lugar de workflow:execute. Un usuario autenticado con acceso de solo lectura a un flujo de trabajo compartido puede usar la API Pública para reintentar ejecuciones de ese flujo de trabajo, omitiendo el límite de permisos previsto entre el acceso de lectura y el de ejecución. Esto afecta a las instancias donde los flujos de trabajo se comparten con otros usuarios o entre proyectos."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "n8n",
"product": "n8n",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n8n",
"versions": [
{
"version": "2.26.0",
"lessThan": "2.26.2",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.26.2",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "n8n",
"product": "n8n",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n8n",
"versions": [
{
"version": "0",
"lessThan": "2.25.7",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.25.7",
"versionType": "semver",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.1,
"impactScore": 2.7
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-08T14:24:00.966635Z",
"id": "CVE-2026-56778",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-863"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*",
"versionEndExcluding": "2.25.7",
"matchCriteriaId": "BF3AA8D6-D35E-4D7B-B4E5-819275C0C91B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "2.26.0",
"versionEndExcluding": "2.26.2",
"matchCriteriaId": "970A6AA3-03FF-4B9D-85C1-462C5C7F7171"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-h3jj-5f3v-3685",
"source": "[email protected]",
"tags": [
"Mitigation",
"Vendor Advisory"
]
},
{
"url": "https://www.vulncheck.com/advisories/n8n-authorization-bypass-in-public-api-execution-retry-endpoint",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
}
]
}