PT-2026-56443 · N8N · N8N

Ksw9722 · Publicado 2026-07-08 · Atualizado 2026-07-08 · CVE-2026-56778

NVD

CVSS v3.1

6.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

n8n before 2.25.7 and 2.26.x before 2.26.2 contains an authorization bypass in the Public API execution retry endpoint, which authorizes access using the workflow:read scope instead of workflow:execute. An authenticated user with read-only access to a shared workflow can use the Public API to retry executions of that workflow, bypassing the intended permission boundary between read and execute access. This affects instances where workflows are shared with other users or across projects.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-56778

Produtos afetados

N8N

Referências · 3

• https://github.com/n8n-io/n8n/security/advisories/GHSA-h3jj-5f3v-3685 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-56778 · Nota de Segurança
• https://vulncheck.com/advisories/n8n-authorization-bypass-in-public-api-execution-retry-endpoint · Nota