Executive brief
n8n is a workflow automation platform used to build and run integrations and business processes. The Insights API, which provides analytics on workflow execution, failed to properly verify that authenticated users belonged to a project before exposing its workflow names and execution statistics. An attacker with a basic insights-viewing role could enumerate all projects on an instance and retrieve sensitive workflow and project names for projects they don't have access to, potentially revealing business operations and client information.
Technical details
The Insights API routes (/rest/insights/*) implement instance-level authorization but fail to enforce per-project authorization checks. A user supplied projectId parameter is passed directly to the repository without validating that the authenticated user is a member of the target project. The vulnerability affects users with insights:list or insights:read scopes, regardless of their actual project membership. Attack vector is network-based, requires low privileges (a valid user account with insights scopes), and does not require user interaction. An attacker can enumerate arbitrary projectIds to extract workflow names, project names, and execution statistics. No credential content or execution details are exposed. The issue is patched in versions 2.36.2 and 2.35.4.
Affected products
- n8n n8n before 2.36.2 and before 2.35.4
Timeline
- 2026-08-19: disclosed
- 2026-09-03: advisory