CVE-2026-77079 is a high severity (8.8) authorization bypass in n8n custom project role deletion. A user with only the role:manageProject scope could delete a role in use and reassign its holders, themselves included, to project:admin. n8n before 2.33.4 and 2.34.1 is affected. Upgrade to those or later.
What's affected
The record says n8n before 2.33.4 and 2.34.x before 2.34.1 are affected. GitHub's advisory lists the same range and says the patched versions are 2.33.4 and 2.34.1 or later.
The component is the custom project role deletion and reassignment path. Only the 2.x lines are named, and the advisory lists no fix for 1.x for this CVE.
Where sources differ. The advisory scores this High 7.4 on CVSS 4.0, and the record's CVSS 3.1 score is different, so the two numbers describe the same flaw through different scoring models.
How to check if you're exposed
Find every n8n instance, including ones a team stood up on its own, and print the version:
n8n --version
docker exec <container> n8n --version
npm ls -g n8n
The first works where the CLI is installed, the second for a Docker container, the third for a global npm install. Compare with the patched versions: 1.123.69 on the 1.x line, 2.33.4 on 2.33, and 2.34.1 on 2.34. Then list users who hold custom global roles with the role:manageProject scope.
GitHub lists these temporary mitigations in the advisory:
- Audit and revoke delegated custom global roles that carry the role:manageProject scope, and limit that scope to fully trusted administrators.
- If the CUSTOM_ROLES feature is not actively required, consider disabling it to remove the affected endpoint entirely.
- Restrict n8n instance access to fully trusted users only.
GitHub is clear that they do not fully remediate the risk and are short-term measures. A dependency scan is the quickest way to find this kind of component across many projects. Safeguard's free in-browser scan at gold.safeguard.sh/scan checks your dependencies against known CVEs, and reachability analysis helps you separate libraries your code actually calls from ones that only sit in the tree.
What to do now
- Upgrade n8n to 2.33.4, or 2.34.1 or later, whichever matches your release line.
- Until you can, apply the advisory's temporary mitigations, which GitHub says reduce risk without fully fixing it.
- Review who has accounts on the instance and what role each holds. Remove people who do not need access.
- Look through existing workflows for the feature involved, and confirm nothing unexpected has been added.
- Re-check the version afterward and record it.
Why it matters
When someone deletes a custom project role and picks a reassignment target, n8n checked only that the target role existed and was project-scoped. It never asked whether the caller had rights over the projects involved. A person holding the narrow role:manageProject scope could therefore move holders of any custom role to the built-in project:admin role and take full control of projects they should not touch. The record files it under CWE-639, authorization bypass through a user-controlled key.
A narrow delegated permission turned into the broadest one. This pattern, where one admin-like scope quietly reaches across every tenant, is worth checking in any multi-project system. The record does not mark it as a CISA KEV entry.
Quick check
What does the attacker gain?
Full administrative control of projects they had no legitimate access to, by reassigning role holders, themselves included, to project:admin.
Does it affect the 1.x line?
The record and advisory name n8n before 2.34.1 and 2.33.4. No 1.x fix is listed for this CVE.
Sources
Last reviewed: 18 October 2026.
