{"id":"GHSA-664h-gpgq-h6xx","revision":"6067ccf8d3524d57b414ae29f8e7b39b","records":[{"revision":"6067ccf8d3524d57b414ae29f8e7b39b","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-664h-gpgq-h6xx","aliases":["CVE-2026-56775"],"title":"n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints","description":"## Impact\nThree mutating endpoints in the evaluation test runs controller authorized state-changing actions using `workflow:read` instead of the action-appropriate `workflow:execute` scope. An authenticated user with `project:viewer` role on a project could start new evaluation test runs, cancel in-flight runs, and delete run records for workflows they only had read access to.\n\nThis issue only affects instances with Advanced Permissions (Enterprise/Cloud) where projects and viewer roles are in use.\n\n## Patches\nThe issue has been fixed in n8n versions 1.123.55, 2.25.7, and 2.26.2. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Restrict project membership to fully trusted users only.\n- Avoid granting viewer access to projects containing sensitive workflows.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","state":0,"publishedAt":"2026-06-17T13:55:59+00:00","modifiedAt":"2026-07-09T04:11:38.3249388+00:00","affected":[{"ecosystem":"npm","name":"n8n","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.123.55"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"n8n","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.26.0"},{"kind":"fixed","version":"2.26.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"n8n","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.0.0-rc.0"},{"kind":"fixed","version":"2.25.7"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/n8n-io/n8n/security/advisories/GHSA-664h-gpgq-h6xx","https://github.com/n8n-io/n8n"],"sourceUrl":"https://github.com/advisories/GHSA-664h-gpgq-h6xx","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-664h-gpgq-h6xx","identifiers":["GHSA-664h-gpgq-h6xx","CVE-2026-56775"]},"retained":false,"historicalAffected":[]}],"coverage":[]}