Authorization Bypass in n8n API Affecting User Access Control

CVE-2026-56778

What is CVE-2026-56778?

The vulnerability within n8n allows an authenticated user to exploit an authorization bypass in the Public API's execution retry endpoint. This issue arises because the API authorizes access using the workflow:read scope instead of the appropriate workflow:execute scope. As a result, users with read-only access to shared workflows can leverage the Public API to retry such executions, thereby circumventing the intended access control measures. This poses a risk in environments where workflows are shared among multiple users or projects, compromising the integrity and security of workflow executions.

References