GHSA-2xgm-wc4g-5jvg: n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects
- Identifiers
- CVE-2026-59253GHSA-2xgm-wc4g-5jvg
- Published
- Record updated
- Affected
- n8n < 2.28.0
- Fixed in
- 2.28.0
- released June 23, 2026, 29 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.3%
Summary
An authenticated user with workflow-creation permission in one n8n project can bypass project and folder authorization checks by sending a crafted request payload. The new workflow is linked to a folder in another project the user cannot access. The workflow stays in the attacker's project, and the impact is limited to a database-level integrity violation of the target project's folder structure, affecting instances with multi-project and folder support enabled.
Mitigation
The issue has been fixed in n8n version 2.28.0. Upgrade to this version or later. As a temporary workaround, restrict project membership and workflow creation permissions to fully trusted users only, noting that this does not fully remediate the risk.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- n8nnpmLLM dependency since 2026-02-10