An authorization bypass vulnerability in n8n allows authenticated users to escalate privileges, posing a risk of total system compromise.

This vulnerability is an authorization bypass (CWE-639) triggered by user-controlled keys. The flaw permits an authenticated user to perform unauthorized actions or gain elevated privileges, effectively bypassing existing security controls within the n8n application.

The ability to bypass authorization mechanisms presents a critical risk to the integrity and confidentiality of the n8n instance. An attacker could gain unauthorized administrative control over workflows or sensitive data, leading to a total compromise of the application environment. The CVSS score of 7.7 reflects the high impact on data and service integrity.

Immediate Action: Update the n8n application to version 1.123.64, 2.30.1, or 2.29.8, depending on the specific branch in use.

Proactive Monitoring: Review application logs for unusual administrative activity or unauthorized access attempts associated with user sessions and SSO integration.

Compensating Controls: Restrict access to the n8n instance to trusted internal networks and utilize strong authentication methods to minimize the risk of compromised user credentials.

Public Exploit Available: Unknown.

Because this vulnerability allows for privilege escalation, it represents a significant threat to the security posture of the n8n deployment. Administrators must apply the provided updates immediately to ensure that authorization logic is correctly enforced and to prevent potential unauthorized access.