CVE-2026-59253
n8n - Improper Authorization in Workflow Assignment to Folders
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jul 8, 2026
- Updated
- Jul 8, 2026
- Reserved
- Jul 4, 2026
Description
n8n before 2.28.0 contains an improper authorization vulnerability allowing authenticated users to assign workflows to folders in other projects. Attackers can bypass project and folder authorization boundaries by supplying crafted request payloads during workflow creation, causing logical integrity violations in target project folder structures.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
n8nn8n |
|
References
- GitHub Security Advisory (GHSA-2xgm-wc4g-5jvg)vendor-advisory
- VulnCheck Advisory: n8n - Improper Authorization in Workflow Assignment to Foldersthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.