CVE-2026-56775 Overview
CVE-2026-56775 is an authorization vulnerability in n8n, the workflow automation platform. Three mutating evaluation test-run endpoints authorize state-changing actions using the workflow:read scope instead of the action-appropriate workflow:execute scope. The flaw affects n8n versions before 1.123.55, 2.25.7, and 2.26.2. On instances using Advanced Permissions (Enterprise/Cloud) with projects and viewer roles, an authenticated user with the project:viewer role can start new evaluation test runs, cancel in-flight runs, and delete run records for workflows they should only be able to read. The vulnerability is tracked under [CWE-863] Incorrect Authorization.
Critical Impact
Authenticated viewers can execute, cancel, and delete evaluation runs on workflows they only have read access to, breaking the intended read-only boundary.
Affected Products
- n8n versions prior to 1.123.55
- n8n versions prior to 2.25.7
- n8n versions prior to 2.26.2 (Enterprise and Cloud deployments using Advanced Permissions)
Discovery Timeline
- 2026-07-08 - CVE-2026-56775 published to NVD
- 2026-07-08 - Last updated in NVD database
Technical Details for CVE-2026-56775
Vulnerability Analysis
n8n implements a scope-based permission model that distinguishes read operations from execute operations. The workflow:read scope should permit only inspection of workflow definitions and metadata. The workflow:execute scope governs state-changing runtime operations such as starting or aborting executions.
The evaluation test-run subsystem exposes three mutating endpoints responsible for creating new test runs, cancelling active runs, and deleting stored run records. These endpoints were guarded by a check for workflow:read rather than workflow:execute. Any principal with read access to a workflow could therefore invoke state-changing actions on it.
The impact is amplified on Enterprise and Cloud tenants that leverage Advanced Permissions with the project:viewer role. A viewer is intended to be a passive observer within a project. Because the viewer role inherits workflow:read, viewers gain the ability to trigger evaluation executions, cancel running evaluations, and destroy historical run records.
Root Cause
The root cause is an incorrect authorization check [CWE-863] applied to the evaluation test-run route handlers. The handlers were bound to the wrong scope constant, treating mutating operations as read operations. No additional server-side verification enforced the write semantics of the underlying action.
Attack Vector
Exploitation requires network access to the n8n API and valid credentials for an account with at least the project:viewer role in a project containing target workflows. An attacker issues authenticated HTTP requests directly to the vulnerable evaluation test-run endpoints. No user interaction, elevated privileges, or additional preconditions are required. Successful exploitation causes unauthorized workflow evaluation executions, disruption of legitimate in-flight test runs, and loss of evaluation history through record deletion.
No public proof-of-concept exploit is currently available. Technical details of the endpoint routing are documented in the VulnCheck Security Advisory and the GitHub Security Advisory GHSA-664h-gpgq-h6xx.
Detection Methods for CVE-2026-56775
Indicators of Compromise
- Evaluation test-run creation, cancellation, or deletion events originating from user accounts assigned the project:viewer role.
- Unexpected spikes in evaluation execution volume, particularly against workflows viewers should not modify.
- Gaps or deletions in evaluation run history that cannot be attributed to workflow owners or editors.
Detection Strategies
- Audit n8n application logs for HTTP calls to evaluation test-run endpoints and correlate the calling identity against its assigned project role.
- Alert when principals holding only workflow:read scope invoke mutating verbs (POST, DELETE) on evaluation routes.
- Baseline normal evaluation activity per workflow owner and flag deviations initiated by non-owner accounts.
Monitoring Recommendations
- Forward n8n audit and access logs to a centralized log platform for retention and correlation.
- Monitor role assignments for the project:viewer role and review any recent grants prior to patching.
- Track outcomes of evaluation test runs to detect resource abuse patterns consistent with viewer-triggered executions.
How to Mitigate CVE-2026-56775
Immediate Actions Required
- Upgrade n8n to 1.123.55, 2.25.7, or 2.26.2 or later, depending on your release branch.
- Review current role assignments and temporarily revoke project:viewer access on sensitive projects until patching is complete.
- Inspect evaluation run history on Enterprise and Cloud tenants for unauthorized executions or deletions.
Patch Information
n8n has released fixed builds in versions 1.123.55, 2.25.7, and 2.26.2. The patch reroutes the three evaluation test-run endpoints to enforce the workflow:execute scope. Full remediation details are provided in the GitHub Security Advisory GHSA-664h-gpgq-h6xx. n8n Cloud tenants are updated by the vendor; self-hosted Enterprise deployments must apply the update manually.
Workarounds
- If patching cannot be performed immediately, remove the project:viewer role from users on projects containing sensitive workflows.
- Restrict network access to the n8n API to trusted administrative networks until upgrade is complete.
- Disable evaluation features in projects where viewer accounts are present, if operationally feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
