CVE-2026-77079: n8n

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion (reassignment) path. When deleting a custom project role with a reassignment target, the code validated only that the target role existed and was project-scoped, performing no project-level authorization check. A user holding only the narrow role:manageProject global scope could delete any custom project role in use on the instance and reassign its holders (including themselves) to the built-in project:admin role, gaining full administrative control of projects they had no legitimate access to.

Affected products

• n8n n8n: before 2.33.4 (fixed in 2.33.4); version 2.34.0 only

Published 2026-08-20. Last modified 2026-09-01.