VDB
CVE-2026-59253
CVE-2026-59253
PUBLISHED
CVSS 5.3 MEDIUM
Reported by VulnCheck · Published July 8, 2026
n8n before 2.28.0 contains an improper authorization vulnerability allowing authenticated users to assign workflows to folders in other projects. Attackers can bypass project and folder authorization boundaries by supplying crafted request payloads during workflow creation, causing logical integrity violations in target project folder structures.
Risk Scores
CVSS 4.0
5.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n8n | n8n | 0, 2.28.0 |
| n8n | n8n | 0, 2.28.0, 0 |
Timeline
- Jul 8, 2026 CVE Published
- Jul 8, 2026 CVE Updated
- Jul 9, 2026 EPSS Score
- Jul 9, 2026 Coalition ESS Score
References
- GitHub Security Advisory (GHSA-2xgm-wc4g-5jvg) vendor-advisory
- VulnCheck Advisory: n8n - Improper Authorization in Workflow Assignment to Folders third-party-advisory