CVE-2026-56775: n8n - Incorrect OAuth Scope Validation in Evaluation Test Runs Endpoints

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-08 · updated 2026-10-29
Weakness: CWE-863

Description

n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization vulnerability in three mutating evaluation test-run endpoints that authorize state-changing actions using the workflow:read scope instead of the action-appropriate workflow:execute scope. On instances using Advanced Permissions (Enterprise/Cloud) with projects and viewer roles, an authenticated user with the project:viewer role can start new evaluation test runs, cancel in-flight runs, and delete run records for workflows they only have read access to.

Affected products

n8n-io n8n: before 1.123.55; from 2.0.0 before 2.25.7; from 2.26.0 before 2.26.2 — fixed in 1.123.55, 2.25.7, 2.26.2
n8n-io n8n: before 1.123.55 — fixed in 1.123.55

How to fix

Upgrade to a fixed version: n8n-io n8n 1.123.55, 2.25.7, 2.26.2; n8n-io n8n 1.123.55. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-56775 or the next vulnerability affects your stack