CVE-2026-85173: n8n before 2.36.2 Missing Authorization via Insights API
n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that allows authenticated users with insights scopes to access workflow names and execution statistics across projects. Attackers can supply arbitrary projectId parameters to retrieve sensitive project and workflow information from projects they have no membership in.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.36.2 - Compensating control
Restrict access to the n8n Insights API routes to only users who are authorized per-project (e.g., limit who can access routes with insights scopes), until all instances are upgraded to 2.36.2.
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker must be authenticated and have insights scopes. The issue allows such users to query Insights API routes for projects where they have no membership.
What information can be exposed?
Affected routes can disclose workflow names and execution statistics from other projects. The disclosed information is obtained by supplying arbitrary projectId parameters.
Are installations running n8n 2.36.2 affected?
The issue is described as affecting n8n versions before 2.36.2. Upgrading to 2.36.2 or later addresses the affected version range.