CVE Intelligence
Analysis AI-assisted

CVE-2026-54307: n8n Improper Authorization Allows Cross-User Credential Access via Shared Workflow Editors

CVE-2026-54307 is an incorrect authorization flaw (CWE-863) in the n8n workflow automation platform. A member-level user with Editor access to a shared workflow could reference credentials they do not own through certain public API endpoints, because ownership checks were only partially enforced. The advisory lists fixed releases 1.123.55, 2.25.7 and 2.26.2, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-54307 affects the n8n workflow automation platform. According to the record, a member-level user who holds Editor access to a shared workflow could reference credentials owned by other users through specific public API endpoints. The root cause is classified as Incorrect Authorization (CWE-863), with ownership checks described as only partially enforced.

Impact

  • Confirmed by the record: cross-user access to credentials, which may include secrets used to connect n8n to external services.
  • Inference: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) indicates network exploitation with low complexity, low privileges required and no user interaction, with high confidentiality and integrity impact and a scope change.
  • The condition requires workflow sharing to be enabled and at least one workflow shared with a member-level user as Editor.

Affected products and versions

  • Product listed: N8n N8n.
  • Versions listed as affected: below 1.123.55; from 2.0.0 up to but not including 2.25.7; and from 2.26.0 up to but not including 2.26.2.
  • Fixed in: 1.123.55, 2.25.7 and 2.26.2, according to the record and the vendor advisory.

Exploitation status

The CISA KEV catalog does not list this CVE. No confirmed exploitation appears in the sources consulted. EPSS data is not available in the record.

Remediation and mitigation

  • Upgrade n8n to 1.123.55 for the 1.x branch, 2.25.7 for the 2.25 line, or 2.26.2 for the 2.26 line.
  • Review the vendor advisory for the mitigation guidance it provides: GHSA-pmqw-72cg-wx85.
  • Until patching is complete, limit which members receive Editor access on shared workflows, since the record ties the issue to that condition.
  • Rotate credentials that may have been exposed to users who should not have access, as a precaution, if instance logs or audit data suggest such access.

Detection guidance

  • Review audit logs and API access records for requests from member-level accounts that reference credentials outside their ownership.
  • Audit which workflows are shared with member users as Editors and remove unnecessary sharing.

Limitations of the available information

  • The record does not provide a CVSS 4.0 vector detail beyond the score of 8.5 reported by the GitHub CNA.
  • The specific public API endpoints involved are not named in the record.
  • The record does not state whether logs would show exploitation, and no proof-of-concept or exploitation evidence was found in the sources consulted.

Frequently asked questions

What is CVE-2026-54307?

It is an incorrect authorization flaw (CWE-863) in n8n that can let a member-level user with Editor access to a shared workflow reference credentials owned by others through certain public API endpoints.

Which n8n versions are fixed?

The record lists fixes in 1.123.55, 2.25.7 and 2.26.2. Affected ranges are below 1.123.55, from 2.0.0 to below 2.25.7, and from 2.26.0 to below 2.26.2.

Is this vulnerability being actively exploited?

The CISA KEV catalog does not list this CVE, and no confirmed exploitation appears in the sources consulted.

What should administrators do now?

Upgrade to a fixed version, review the vendor advisory, and limit Editor access on shared workflows until patching is complete.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.