CVE-2026-59253: 
NixOS 취약성 분석 및 완화

CVE-2026-59253 is an improper authorization vulnerability in n8n, the open-source workflow automation platform, that allows authenticated users to assign workflows to folders belonging to other projects they are not authorized to access. It affects all n8n versions before 2.28.0 running on Node.js. The vulnerability was published on July 8, 2026, with the underlying security advisory (GHSA-2xgm-wc4g-5jvg) originally published by n8n on June 24, 2026. It carries a CVSS v3.1 score of 5.0 (Medium) and a CVSS v4.0 score of 5.3 (Medium) (GitHub Advisory, Github Advisory).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key): the workflow creation endpoint does not validate whether the folder ID supplied in the request payload belongs to a project the authenticated user is authorized to access. An attacker with a valid account and workflow creation permissions in their own project can craft a request payload that references a folder ID from a different project, causing the newly created workflow to be associated with that foreign folder at the database level. This issue only affects n8n instances with multi-project and folder support enabled. No public proof-of-concept code has been identified (GitHub Advisory, Github Advisory).

Successful exploitation results in a logical integrity violation of the target project's folder structure at the database level. The created workflow remains in the attacker's own project and is not visible to the target project's members; no data from the target project is exposed and no confidentiality or availability impact occurs. The impact is limited to unauthorized modification of folder-workflow associations in other projects, which can disrupt organizational structure and workflow management for affected teams (GitHub Advisory).

1. Obtain authenticated access: Log in to a vulnerable n8n instance (version < 2.28.0) with any account that has workflow creation permissions in at least one project.
2. Enumerate target folder IDs: Use the n8n API or UI to identify or enumerate folder IDs belonging to other projects (e.g., by observing folder ID patterns or making API calls to list folders).
3. Craft a malicious workflow creation request: Intercept or manually construct a POST request to the workflow creation API endpoint, injecting a folderId value that references a folder in a target project the attacker does not have access to.
4. Submit the crafted request: Send the request to the n8n API. The server fails to validate project ownership of the supplied folder ID and associates the new workflow with the target project's folder at the database level.
5. Observe the integrity violation: The workflow is created in the attacker's project but is now linked to the target project's folder in the database, causing logical corruption of the target project's folder structure (GitHub Advisory).

• Logs: n8n API access logs showing authenticated POST requests to workflow creation endpoints with folder IDs that do not belong to the requesting user's project; repeated requests from a single user account targeting multiple different folder IDs.
• Database: Workflow records in the database where the associated folderId references a folder belonging to a different project than the workflow's owning project; unexpected folder-workflow associations in the n8n database tables.
• Application Behavior: Project administrators observing unexpected or unexplained workflow entries linked to their project folders without having created them; discrepancies between the UI-visible workflow list and database-level folder associations.

Upgrade n8n to version 2.28.0 or later, which contains the fix for this vulnerability (GitHub Advisory). If immediate upgrade is not possible, administrators should restrict project membership and workflow creation permissions to fully trusted users only — note this is a partial mitigation and does not fully remediate the risk. After patching, administrators should audit existing workflow-folder assignments across all projects to identify and remediate any unauthorized associations that may have occurred prior to the fix.