CVE-2026-56778

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.25.7 n8n versions 2.26.x prior to 2.26.2

Description An authorization bypass exists in the Public API execution retry endpoint. The system incorrectly authorizes access using the workflow:read scope instead of the required workflow:execute scope. This allows an authenticated user who only has read-only access to a shared workflow to retry executions of that workflow, bypassing the permission boundary between read and execute access. This issue occurs in instances where workflows are shared across projects or with other users.

Recommendations Update n8n to version 2.25.7 or later. Update n8n to version 2.26.2 or later.