poslední zpráva · zachyceno
SPOJENO AI EPSS 0.01 (nejvyšší)
n8n: Custom Instance Role with User Management Permissions Gives Control of the Owner Account
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.5, CVEs: , Summary: n8n protected the instance owner account from changes by every other user. The password reset link and role change operations did not apply that protection to users with a custom instance role. A user whose custom instance role included user management permissions could obtain a password reset link for the owner and take over the owner account, or change the owner's role. This gave the…
n8n FI IT CA
CVE v události 4
| CVE | hodnocení | KEV | EPSS |
|---|---|---|---|
| CVE-2026-126383 | 8.2 3.1 · VulnCheck 5.3 4.0 · VulnCheck | – | < 0.01 |
| CVE-2026-126384 | 7.7 4.0 · VulnCheck 7.5 3.1 · VulnCheck | – | 0.01 |
| CVE-2026-126385 | 7.7 3.1 · VulnCheck 4.8 4.0 · VulnCheck | – | < 0.01 |
| CVE-2026-126391 | 7.7 4.0 · VulnCheck 7.5 3.1 · VulnCheck | – | 0.01 |
Hodnocení z katalogů, všechna, se stupnicí CVSS a vydavatelem. Rozpad vektoru je na stránce CVE. Advisory v textu uvádí CVSS 7.5.
Jak se o tom psalo 3
-
· zachyceno · NCSC-FI FI nadpis události
n8n: Custom Instance Role with User Management Permissions Gives Control of the Owner Account
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.5, CVEs: , Summary: n8n protected the instance owner account from changes by every other user. The password reset link and role change operations did not apply that protection to users with a custom instance role. A user whose custom instance role included user management permissions could obtain a password reset link for the owner and take over the owner account, or change the owner's role. This gave the…
-
· CSIRT Itálie (ACN) IT
Vulnerabilità in n8n
Rilasciati aggiornamenti di sicurezza per sanare alcune vulnerabilità, di cui 4 con gravità “alta”, in n8n, piattaforma open‑source di workflow automation che consente di integrare applicazioni, servizi e API tramite flussi visuali. Tali vulnerabilità potrebbero consentire a un attaccante l'elusione dei meccanismi di autenticazione, la modifica non autorizzata di dati e l'esecuzione di codice arbitrario sui sistemi interessati.
-
· Cyber Centre Kanada CA
n8n security advisory (AV26-1160)
Serial number: AV26-1160 Date: November 13, 2026 As of November 13, 2026, n8n is affected by vulnerabilities in the following product: n8n Prior to 2.45.5 Prior to 2.46.1 Prior to 3.0.1 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. OAuth Account Hijack in the End-User Credential Connect Flow via Unauthenticated Callback Overview · n8n-io/n8n · GitHub