CVE-2026-59253: n8n - Improper Authorization in Workflow Assignment to Folders

Severity: medium (CVSS 5.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-08 · updated 2026-07-08
Weakness: CWE-639

Description

n8n before 2.28.0 contains an improper authorization vulnerability allowing authenticated users to assign workflows to folders in other projects. Attackers can bypass project and folder authorization boundaries by supplying crafted request payloads during workflow creation, causing logical integrity violations in target project folder structures.

Affected products

n8n-io n8n: before 2.28.0 — fixed in 2.28.0

How to fix

Upgrade to a fixed version: n8n-io n8n 2.28.0. Check the vendor advisory for mitigations.

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-2xgm-wc4g-5jvg
https://www.vulncheck.com/advisories/n8n-improper-authorization-in-workflow-assignment-to-folders

Get alerted when CVE-2026-59253 or the next vulnerability affects your stack