PT-2026-56443 · N8N · N8N

Ksw9722 · Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-56778

NVD

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

n8n before 2.25.7 and 2.26.x before 2.26.2 contains an authorization bypass in the Public API execution retry endpoint, which authorizes access using the workflow:read scope instead of workflow:execute. An authenticated user with read-only access to a shared workflow can use the Public API to retry executions of that workflow, bypassing the intended permission boundary between read and execute access. This affects instances where workflows are shared with other users or across projects.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-56778

Affected Products

N8N

References · 3

• https://github.com/n8n-io/n8n/security/advisories/GHSA-h3jj-5f3v-3685 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56778 · Security Note
• https://vulncheck.com/advisories/n8n-authorization-bypass-in-public-api-execution-retry-endpoint · Note