CVE-2026-77079: n8n before 2.34.1 Authorization Bypass via Custom Role Deletion
n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion (reassignment) path. When deleting a custom project role with a reassignment target, the code validated only that the target role existed and was project-scoped, performing no project-level authorization check. A user holding only the narrow role:manageProject global scope could delete any custom project role in use on the instance and reassign its holders (including themselves) to the built-in project:admin role, gaining full administrative control of projects they had no legitimate access to.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs an authenticated n8n account with the global role:manageProject scope. They do not need legitimate access to the projects affected by the reassignment.
What can an attacker gain through the vulnerable reassignment path?
They can delete a custom project role in use and reassign its holders, including themselves, to the built-in project:admin role. This grants full administrative control over projects they were not authorized to access.
What conditions are required for the vulnerable operation?
A custom project role must be deleted with a reassignment target that exists and is project-scoped. The vulnerable code checks those target-role properties but does not perform a project-level authorization check.
Which n8n versions are identified as affected?
The issue affects n8n versions before 2.34.1 and 2.33.4.