CVE-2026-77079: n8n before 2.34.1 Authorization Bypass via Custom Role Deletion

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-20 · updated 2026-10-24
Weakness: CWE-639

Description

n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion (reassignment) path. When deleting a custom project role with a reassignment target, the code validated only that the target role existed and was project-scoped, performing no project-level authorization check. A user holding only the narrow role:manageProject global scope could delete any custom project role in use on the instance and reassign its holders (including themselves) to the built-in project:admin role, gaining full administrative control of projects they had no legitimate access to.

Affected products

n8n-io n8n: before 2.33.4; 2.34.0 — fixed in 2.33.4

How to fix

Upgrade to a fixed version: n8n-io n8n 2.33.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-77079 or the next vulnerability affects your stack