Executive brief
n8n is a workflow automation platform used to connect and automate business processes. Two API endpoints that manage role assignments failed to properly check whether a user could access a project before revealing its members' names and email addresses. An attacker with role-management permissions could abuse this to discover and extract personally identifiable information about employees in projects they don't have access to. This could lead to unauthorized data exposure and cross-tenant information disclosure in multi-tenant deployments.
Technical details
This is a missing authorization (CWE-862) vulnerability in n8n's role assignment API endpoints. The endpoints `/rest/roles/:slug/assignments` and `/rest/roles/:slug/assignments/:projectId/members` performed only role-type management checks but failed to validate project-level access controls. An authenticated attacker holding the `role:manageProject` permission could request information about any project by name and receive member lists containing full names and email addresses, regardless of their access to that project. The vulnerability affects versions >= 2.38.0 and < 2.38.2, and all versions < 2.37.7. The fix adds project-access scope checks to both routes, returning not-found responses for projects the caller cannot list. Attack requires network access, high privileges (role-management permission), and no user interaction.
Affected products
- n8n n8n >= 2.38.0, < 2.38.2 and < 2.37.7
Timeline
- 2026-09-02: disclosed: GitHub advisory published
- 2026-09-02: patched: Patches released in versions 2.38.2 and 2.37.7
- 2026-09-10: advisory: Advisory updated and published to GitHub Advisory Database