Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: n8n 1.123.55 Clear all filters
TI-2026-40940 CVE-2026-56776 · GHSA-xhqv-vmw5-79pm

n8n - Incorrect OAuth Scope Validation in Workflow Test Run Endpoint

Priority LOW 24

n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/{workflowId}/test-runs/new endpoint, which authorizes access using the workflow:read scope instead of workflow:execute.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00276 Published 2026-07-08 Fixed in 1.123.55, 2.26.2 +1 CWE-863
TI-2026-40939 CVE-2026-56775 · GHSA-w79j-mf7m-gfpm

n8n - Incorrect OAuth Scope Validation in Evaluation Test Runs Endpoints

Priority LOW 24

n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization vulnerability in three mutating evaluation test-run endpoints that authorize state-changing actions using the workflow:read scope instead of the action-ap…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00302 Published 2026-07-08 Fixed in 1.123.55, 2.26.2 +1 CWE-863