Medium severity4.3NVD Advisory· Published Sep 3, 2026· Updated Sep 16, 2026
CVE-2026-85173
CVE-2026-85173
Description
n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that allows authenticated users with insights scopes to access workflow names and execution statistics across projects. Attackers can supply arbitrary projectId parameters to retrieve sensitive project and workflow information from projects they have no membership in.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
2- github.com/n8n-io/n8n/security/advisories/GHSA-jmmj-93rg-6j39nvdMitigationVendor Advisory
- www.vulncheck.com/advisories/n8n-before-2.36.2-missing-authorization-via-insights-apinvdThird Party Advisory
News mentions
1- N8n Io: Nine Vulnerabilities Including RCE and Credential Exposure Disclosed TogetherVypr Intelligence · Sep 3, 2026