CVE-2026-85173

4.3 Moyenne

Publiée le 03/09/2026 à 15:06 · Modifiée le 16/09/2026 à 23:21 · Analysée par le NVD · Source : disclosure@vulncheck.com

Description

n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that allows authenticated users with insights scopes to access workflow names and execution statistics across projects. Attackers can supply arbitrary projectId parameters to retrieve sensitive project and workflow information from projects they have no membership in.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
4.0	5.3 Moyenne	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	4.3 Moyenne	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-639

Références

https://github.com/n8n-io/n8n/security/advisories/GHSA-jmmj-93rg-6j39 MitigationVendor Advisory
https://www.vulncheck.com/advisories/n8n-before-2.36.2-missing-authorization-via-insights-api Third Party Advisory

CVE-2026-85173

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs