p PatchFirst

CVE-2026-56778

CVE-2026-56778 · n8n - Authorization Bypass in Public API Execution Retry Endpoint

This page contains facts from public vulnerability sources. Check the original advisory before updating.

n8n before 2.25.7 and 2.26.x before 2.26.2 contains an authorization bypass in the Public API execution retry endpoint, which authorizes access using the workflow:read scope instead of workflow:execute. An authenticated user with read-only access to a shared workflow can use the Public API to retry executions of that workflow, bypassing the intended permission boundary between read and execute access. This affects instances where workflows are shared with other users or across projects.

CVSS 5.3 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • n8n

    Versions
    • ≥ 0, < 2.26.2: Affected (semver)
    • 2.26.2: Not affected (semver)

    Update to 2.26.2

  • n8n

    Versions
    • ≥ 0, < 2.25.7: Affected (semver)
    • 2.25.7: Not affected (semver)

    Update to 2.25.7

  • n8n npm

    Affected ranges
    • SEMVER: ≥ 2.26.0, < 2.26.2

    Update to 2.26.2

  • n8n npm

    Affected ranges
    • SEMVER: < 2.25.7

    Update to 2.25.7

Original sources

Check your server →