VULNERABILITY INTELLIGENCE

CVE-2026-56778

CVSS score6.4 MEDIUM
EPSS probability0.29%
CISA KEVNot currently listed
Published2026-07-08
Last modified2026-10-29
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Description

n8n before 2.25.7 and 2.26.x before 2.26.2 contains an authorization bypass in the Public API execution retry endpoint, which authorizes access using the workflow:read scope instead of workflow:execute. An authenticated user with read-only access to a shared workflow can use the Public API to retry executions of that workflow, bypassing the intended permission boundary between read and execute access. This affects instances where workflows are shared with other users or across projects.

Weakness classification

  • disclosure@vulncheck.com: CWE-863

Primary references