Authorization Bypass in n8n Workflow Management Software by n8n-io

CVE-2026-118649

What is CVE-2026-118649?

In n8n versions before 2.43.5 and 2.44.x prior to 2.44.1, a severe vulnerability exists that allows an authenticated user to manipulate workflow IDs. By injecting a crafted workflow ID, specifically utilizing the prototype chain (proto), an attacker can bypass the intended authorization checks for the Data Table project. This flaw permits unauthorized users to list, read, modify, and delete rows across all projects within the n8n instance, posing a significant risk to data integrity and confidentiality.

References