CVE-2026-59253CWE-639

n8n - Improper Authorization in Workflow Assignment to Folders

Medium · published July 8, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
19.4
In the wild
Unconfirmed
What it is

n8n before 2.28.0 contains an improper authorization vulnerability allowing authenticated users to assign workflows to folders in other projects. Attackers can bypass project and folder authorization boundaries by supplying crafted request payloads during workflow creation, causing logical integrity violations in target project folder structures.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
EPSS
0.00280 · 19.4th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-07-08T13:49Z
EPSS history
Timeline
  • 08 JUL 13:49Z
    n8n - Improper Authorization in Workflow Assignment to Folders
    cvelistv5