CVE-2026-86085: n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members endpoints checked only whether the caller could manage the role type. A caller with role:manageProject could name a project the caller could not list and obtain member names and email addresses. The affected controller is packages/cli/src/controllers/role.controller.ts, which omitted the project:list scope check. This issue is fixed in versions 2.37.7 and 2.38.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.37.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.38.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated caller with the role:manageProject permission can exploit it. The caller does not need permission to list the target project, provided they can supply that project's identifier to the affected role-assignment endpoint.
What information could be disclosed?
The affected endpoints can disclose names and email addresses of members of a project that the caller is not authorized to list.
Which versions should be remediated?
Versions prior to 2.37.7 and 2.38.2 are affected. Upgrade to 2.37.7 or 2.38.2 as appropriate for the deployed release line.
How can I determine whether an instance is exposed?
An instance is exposed if it runs a version earlier than 2.37.7 or 2.38.2 and has users granted role:manageProject. Exposure requires a project whose identifier can be supplied by such a user even though that user cannot list the project.