CVE catalog

CVE-2026-56778

n8n before 2.25.7 and 2.26.x before 2.26.2 contains an authorization bypass in the Public API execution retry endpoint, which authorizes access using the workflow:read scope instead of workflow:execut

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
Source
[NVD] · [CVE record]
EPSS
0.29% · Oct 25, 2026

n8n before 2.25.7 and 2.26.x before 2.26.2 contains an authorization bypass in the Public API execution retry endpoint, which authorizes access using the workflow:read scope instead of workflow:execute. An authenticated user with read-only access to a shared workflow can use the Public API to retry executions of that workflow, bypassing the intended permission boundary between read and execute access. This affects instances where workflows are shared with other users or across projects.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Cpen8nNot reported2.25.7fixed
Cpen8nNot reported2.26.2fixed
Cpen8nNot reported2.26.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Cpen8ncpeNot reported2.25.7Not reportedNot reportedNot reported
Cpen8ncpeNot reported2.26.2Not reportedNot reportedNot reported
Cpen8ncpeNot reported2.26.2Not reportedNVD-CVE-2026-56778Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)]