CVE-2026-86085: 
NixOS vulnerability analysis and mitigation

CVE-2026-86085 is a missing authorization vulnerability in n8n, an open-source workflow automation platform, that allows authenticated users with role:manageProject permission to enumerate member names and email addresses from projects they are not authorized to access. The flaw was published on September 2, 2026, by researcher mtholmquist, and formally published to the NVD on September 8, 2026. Affected versions include all n8n releases prior to 2.37.7 and versions 2.38.0 through 2.38.1 (prior to 2.38.2). It carries a CVSS v3.1 base score of 4.9 (Medium) and a CVSS v4.0 base score of 5.1 (Medium) (Github Advisory, n8n Security Advisory).

The root cause is a missing authorization check (CWE-862) in the role assignment controller located at packages/cli/src/controllers/role.controller.ts. The endpoints /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members validated only whether the caller held the role:manageProject scope, but omitted the required project:list scope check that would confirm the caller has visibility into the target project. An attacker with a valid account holding role-management privileges can craft HTTP requests to these endpoints, supplying the identifier of any project on the instance — including those they cannot normally list — and receive back member names and email addresses in the response. The fix adds a project-access check to both routes, returning a not-found response for projects the caller cannot list (Github Advisory, n8n Security Advisory).

Successful exploitation allows an authenticated attacker to enumerate the names and email addresses (PII) of members belonging to any project on the n8n instance, regardless of their actual project access permissions. This constitutes a cross-tenant information disclosure that could expose organizational structure and user identity data across all projects hosted on a shared n8n instance. There is no integrity or availability impact; the vulnerability is limited to confidentiality loss, but the exposed PII could facilitate targeted phishing or social engineering attacks against project members (Github Advisory, n8n Security Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). Exploitation requires an authenticated account with the role:manageProject permission, which limits the attacker pool to privileged insiders or compromised accounts. The EPSS score is approximately 0.263% (18th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Obtain privileged access: Acquire or compromise an n8n account that holds the role:manageProject permission on the target instance running a vulnerable version (< 2.37.7 or 2.38.0–2.38.1).
2. Enumerate project identifiers: Use legitimate n8n API endpoints or UI features accessible to the attacker's account to discover project slugs or IDs present on the instance (e.g., via /rest/projects if partially accessible, or by guessing/brute-forcing project slugs).
3. Query the vulnerable endpoint: Send an authenticated HTTP GET request to /rest/roles/:slug/assignments/:projectId/members, substituting a target project ID the attacker cannot normally list. Example: GET /rest/roles/member/assignments/<target-project-id>/members with a valid session cookie or API key.
4. Harvest PII: Parse the JSON response, which returns member names and email addresses for the specified project, bypassing the intended project-level access control (Github Advisory, n8n Security Advisory).

• Network: Repeated or scripted HTTP GET requests to /rest/roles/:slug/assignments or /rest/roles/:slug/assignments/:projectId/members from a single authenticated user, particularly targeting project IDs not associated with that user's normal activity.
• Logs: n8n application or web server access logs showing a single user account querying role assignment endpoints for multiple distinct project IDs in a short time window, especially projects the user has no membership in.
• Behavioral: An account with role:manageProject scope making API calls to member-listing endpoints for projects outside its normal scope, which may appear anomalous in audit or activity logs.

The issue is patched in n8n versions 2.37.7 and 2.38.2; users should upgrade to one of these versions or later as the primary remediation (n8n Release 2.37.7, n8n Release 2.38.2). If immediate upgrade is not possible, administrators should restrict n8n instance access to fully trusted users only and audit or revoke any custom global roles carrying the role:manageProject scope, limiting it to the minimum necessary users. These workarounds do not fully remediate the risk and should be treated as temporary measures only (Github Advisory).