CVE-2026-56776 Details
Description
n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/{workflowId}/test-runs/new endpoint, which authorizes access using the workflow:read scope instead of workflow:execute. An authenticated user with read-only access to a workflow can trigger a real evaluation test run, causing the workflow to execute via the internal workflow runner and resulting in unintended outbound API calls, data mutations, or other side effects in connected downstream systems. The issue primarily affects instances using the Evaluations feature where RBAC project roles grant workflow:read without workflow:execute.
A vulnerability exists in n8n versions prior to 1.123.55, 2.25.7, and 2.26.2, allowing an authorization bypass in the POST /workflows/{workflowId}/test-runs/new endpoint. This endpoint incorrectly authorizes access using the workflow:read scope instead of workflow:execute. As a result, an authenticated user with read-only access to a workflow can initiate a real evaluation test run. This execution occurs through the internal workflow runner, potentially leading to unintended outbound API calls, data changes, or other side effects in connected downstream systems. The vulnerability is particularly relevant for instances using the Evaluations feature, where RBAC project roles provide workflow:read access without workflow:execute.
Users should upgrade to n8n versions 1.123.55, 2.25.7, or 2.26.2. If an immediate upgrade is not possible, restrict workflow access to trusted users and audit project role assignments to limit workflow:read access on sensitive workflows.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/n8n-io/n8n/security/advisories/GHSA-hv7x-3x78-gx53 | [email protected] | MitigationVendor Advisory |
| https://www.vulncheck.com/advisories/n8n-incorrect-oauth-scope-validation-in-workflow-test-run-endpoint | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| n8n n8n | < 1.123.55 >= 2.0.0, < 2.25.7 >= 2.26.0, < 2.26.2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | Initial Analysis | [email protected] |
| Jul 8, 2026 | New CVE Received | [email protected] |