{"id":"EUVD-2026-47639","revision":"549a839c69464fd8b8a8955c580104ac","records":[{"revision":"549a839c69464fd8b8a8955c580104ac","observedAt":"2026-10-30T10:57:59.019+00:00","statement":{"source":"euvd","id":"EUVD-2026-47639","aliases":["CVE-2026-65595","GHSA-wq64-hcrf-8m56","GHSA-777w-rpr6-c52h"],"title":"n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardless of the acting user's role. On instances where the Token Exchange feature and Public API are enabled, a low-privileged…","description":"n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardless of the acting user's role. On instances where the Token Exchange feature and Public API are enabled, a low-privileged user who can obtain a valid external JWT trusted by a configured issuer can use the resulting access token to invoke administrator-only Public API operations such as role escalation, user creation, and user deletion (role escalation requires an Advanced Permissions license), and, when unverified Community Package installation is enabled, achieve remote code execution.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L","score":8.9,"severity":null}],"references":["https://github.com/n8n-io/n8n/security/advisories/GHSA-777w-rpr6-c52h","https://www.vulncheck.com/advisories/n8n-before-privilege-escalation-via-token-exchange"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-47639","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 22, 2026, 11:21:43 AM","dateUpdated":"Oct 29, 2026, 9:16:25 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-47639","identifiers":["EUVD-2026-47639","CVE-2026-65595","GHSA-wq64-hcrf-8m56","GHSA-777w-rpr6-c52h"]},"retained":false,"historicalAffected":[]}],"coverage":[]}