CVE-2026-85173CWE-639

CVE-2026-85173

Medium · published September 3, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
27.1
In the wild
Unconfirmed
What it is

n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that allows authenticated users with insights scopes to access workflow names and execution statistics across projects. Attackers can supply arbitrary projectId parameters to retrieve sensitive project and workflow information from projects they have no membership in.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00347 · 27.1th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-03T17:06Z
Affected products (2)
ProductVersionsFixed in
n8n/n8n< 2.35.42.35.4
n8n/n8n≥ 2.36.0, < 2.36.22.36.2
References (2)
https://github.com/n8n-io/n8n/security/advisories/GHSA-jmmj-93rg-6j39 · [email protected]https://www.vulncheck.com/advisories/n8n-before-2.36.2-missing-authorization-via-insights-api · [email protected]
EPSS history
Timeline
  • 05 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 03 SEP 11:22Z
    n8n before 2.36.2 Missing Authorization via Insights API
    cvelistv5