CVE-2026-56775

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.55 n8n versions prior to 2.25.7 n8n versions prior to 2.26.2

Description An authorization issue exists in three mutating evaluation test-run endpoints. These endpoints incorrectly authorize state-changing actions using the workflow:read scope instead of the required workflow:execute scope. On instances utilizing Advanced Permissions (Enterprise/Cloud) with projects and viewer roles, an authenticated user assigned the project:viewer role can initiate new evaluation test runs, cancel active runs, and delete run records for workflows to which they only have read access.

Recommendations Update n8n to version 1.123.55 or later. Update n8n to version 2.25.7 or later. Update n8n to version 2.26.2 or later.