PT-2026-85005

CVE-2026-85173

Published

2026-09-03

Updated

2026-09-03

Description by

CVSS 4.0

5.3

Medium

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.36.2

Description Insufficient per-project authorization in the Insights API routes allows authenticated users with insights scopes to access workflow names and execution statistics across different projects. An attacker can provide arbitrary projectId parameters to retrieve sensitive project and workflow information from projects to which they do not belong.

Recommendations Update to version 2.36.2 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Nlgbao1340

Vendors

Affected products

Weakness enumeration

CWE-639: Authorization Bypass Through User-Controlled Key

Related identifiers