Servers and applications
GHSA-q8rc-7m84-mfvj
Custom Instance Role with User Management Permissions Gives Control of the Owner Account
- Severity
- High 7.5
- Published
- 13 Nov 2026
- Last changed
- 13 Nov 2026
- Added to UpHeron
- 13 Nov 2026
- Fixed in
- 2.47.6, 2.48.3, 3.2.2
- Attack
- Over the network · Only under certain conditions · Needs an administrator account · No user action needed
- Attacker can
- Read data · Change data · Take it down
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N- Sources
- Project advisories (GitHub)
Description
n8n protected the instance owner account from changes by every other user. The password reset link and role change operations did not apply that protection to users with a custom instance role. A user whose custom instance role included user management permissions could obtain a password reset link for the owner and take over the owner account, or change the owner's role. This gave the attacker full control of the instance.
Exploitation required the custom roles feature and a custom instance role with user management permissions assigned to the attacker.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Restrict n8n instance access to fully trusted users only.
- Remove user management permissions from custom instance roles assigned to users who are not fully trusted.
- Enable two-factor authentication on the owner account.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Affected software
| Software | Affected versions |
|---|---|
n8nServers and applications · github:n8n-io/n8n |
|
References
- GitHub Advisory Database https://github.com/advisories/GHSA-q8rc-7m84-mfvj
- github.com https://github.com/n8n-io/n8n/security/advisories/GHSA-q8rc-7m84-mfvj