CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
5659 vulnerabilities reference this CWE, most recent first.
GHSA-Q58M-53VR-29P7
Vulnerability from github – Published: 2025-11-20 18:31 – Updated: 2025-11-24 15:30SOPlanning is vulnerable to Privilege Escalation in user management tab. Users with user_manage_team role are allowed to modify permissions of users. However, they are able to assign administrative permissions to any user including themselves. This allow a malicious authenticated attacker with this role to escalate to admin privileges. This issue affects both Bulk Update functionality and regular edition of user's right and privileges.
This issue was fixed in version 1.55.
{
"affected": [],
"aliases": [
"CVE-2025-62730"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-20T16:16:00Z",
"severity": "HIGH"
},
"details": "SOPlanning is vulnerable to Privilege Escalation in user management tab. Users with user_manage_team role are allowed to modify permissions of users. However, they are able to assign administrative permissions to any user including themselves. This allow a malicious authenticated attacker with this role to escalate to admin privileges. This issue affects both Bulk Update functionality and regular edition of user\u0027s right and privileges.\n\nThis issue was fixed in version 1.55.",
"id": "GHSA-q58m-53vr-29p7",
"modified": "2025-11-24T15:30:28Z",
"published": "2025-11-20T18:31:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62730"
},
{
"type": "WEB",
"url": "https://cert.pl/en/posts/2025/11/CVE-2025-62293"
},
{
"type": "WEB",
"url": "https://www.soplanning.org/en"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-Q58Q-5FJ7-R8PX
Vulnerability from github – Published: 2023-07-24 09:30 – Updated: 2024-04-04 06:19An improper privilege check in the OTRS ticket move action in the agent interface allows any as agent authenticated attacker to to perform a move of an ticket without the needed permission. This issue affects OTRS: from 8.0.X before 8.0.35.
{
"affected": [],
"aliases": [
"CVE-2023-38058"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-24T09:15:10Z",
"severity": "MODERATE"
},
"details": "An improper privilege check in the OTRS ticket move action in the agent interface allows any as agent authenticated attacker to to perform a move of an ticket without the needed permission.\nThis issue affects OTRS: from 8.0.X before 8.0.35.\n\n",
"id": "GHSA-q58q-5fj7-r8px",
"modified": "2024-04-04T06:19:37Z",
"published": "2023-07-24T09:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38058"
},
{
"type": "WEB",
"url": "https://otrs.com/release-notes/otrs-security-advisory-2023-07"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-Q5C9-XWJV-3HCQ
Vulnerability from github – Published: 2022-01-12 00:00 – Updated: 2024-11-14 21:31Secure Boot Security Feature Bypass Vulnerability.
{
"affected": [],
"aliases": [
"CVE-2022-21894"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-11T21:15:00Z",
"severity": "MODERATE"
},
"details": "Secure Boot Security Feature Bypass Vulnerability.",
"id": "GHSA-q5c9-xwjv-3hcq",
"modified": "2024-11-14T21:31:49Z",
"published": "2022-01-12T00:00:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21894"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21894"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21894"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-Q5GP-C57F-33X3
Vulnerability from github – Published: 2025-01-21 21:30 – Updated: 2025-01-21 21:30Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security). Supported versions that are affected are 7.4.0, 7.4.1 and 7.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Order and Service Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Communications Order and Service Management accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
{
"affected": [],
"aliases": [
"CVE-2025-21554"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-21T21:15:22Z",
"severity": "MODERATE"
},
"details": "Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security). Supported versions that are affected are 7.4.0, 7.4.1 and 7.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Order and Service Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Communications Order and Service Management accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).",
"id": "GHSA-q5gp-c57f-33x3",
"modified": "2025-01-21T21:30:56Z",
"published": "2025-01-21T21:30:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21554"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujan2025.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-Q5GV-XXQ5-3M7C
Vulnerability from github – Published: 2026-07-22 00:32 – Updated: 2026-07-22 00:32Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1).
A vulnerability exists in Kibana's Machine Learning functionality where a Machine Learning management endpoint performs an insufficient authorization check. The endpoint validates only a coarse privilege level but does not verify that the requesting user has access to the specific Machine Learning job or notification resources provided in the request. As a result, a low-privileged user with Machine Learning access in any Kibana space can manipulate Machine Learning audit and notification records for arbitrary jobs—including jobs in other spaces or belonging to other users—by leveraging Kibana's internally elevated credentials to write to restricted Machine Learning system indices that the user cannot access directly.
{
"affected": [],
"aliases": [
"CVE-2026-63145"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-21T23:18:02Z",
"severity": "MODERATE"
},
"details": "Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1).\n\nA vulnerability exists in Kibana\u0027s Machine Learning functionality where a Machine Learning management endpoint performs an insufficient authorization check. The endpoint validates only a coarse privilege level but does not verify that the requesting user has access to the specific Machine Learning job or notification resources provided in the request. As a result, a low-privileged user with Machine Learning access in any Kibana space can manipulate Machine Learning audit and notification records for arbitrary jobs\u2014including jobs in other spaces or belonging to other users\u2014by leveraging Kibana\u0027s internally elevated credentials to write to restricted Machine Learning system indices that the user cannot access directly.",
"id": "GHSA-q5gv-xxq5-3m7c",
"modified": "2026-07-22T00:32:36Z",
"published": "2026-07-22T00:32:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63145"
},
{
"type": "WEB",
"url": "https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-69/388572"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-Q5HH-5WXX-G45W
Vulnerability from github – Published: 2022-05-24 19:09 – Updated: 2022-07-13 00:01IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive information to an unauthorized user through HTTP GET requests. This information could be used in further attacks against the system. IBM X-Force ID: 198920.
{
"affected": [],
"aliases": [
"CVE-2021-20539"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-02T17:15:00Z",
"severity": "MODERATE"
},
"details": "IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive information to an unauthorized user through HTTP GET requests. This information could be used in further attacks against the system. IBM X-Force ID: 198920.",
"id": "GHSA-q5hh-5wxx-g45w",
"modified": "2022-07-13T00:01:05Z",
"published": "2022-05-24T19:09:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20539"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/198920"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6476940"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-Q5J2-4886-WVHF
Vulnerability from github – Published: 2022-05-24 19:05 – Updated: 2022-07-15 00:00An improper access control vulnerability in ScreenOffActivity in Samsung Notes prior to version 4.2.04.27 allows untrusted applications to access local files.
{
"affected": [],
"aliases": [
"CVE-2021-25405"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-11T15:15:00Z",
"severity": "MODERATE"
},
"details": "An improper access control vulnerability in ScreenOffActivity in Samsung Notes prior to version 4.2.04.27 allows untrusted applications to access local files.",
"id": "GHSA-q5j2-4886-wvhf",
"modified": "2022-07-15T00:00:18Z",
"published": "2022-05-24T19:05:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25405"
},
{
"type": "WEB",
"url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2021\u0026month=5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-Q5Q9-2RHP-33QW
Vulnerability from github – Published: 2026-03-09 17:42 – Updated: 2026-03-09 17:42Impact
When graphQLPublicIntrospection is disabled, __type queries nested inside inline fragments (e.g. ... on Query { __type(name:"User") { name } }) bypass the introspection control, allowing unauthenticated users to perform type reconnaissance. __schema introspection is not affected.
Patches
The check was changed from a flat iteration over root-level selections to a recursive walk of all selection sets, detecting __type inside inline fragments at any depth.
Workarounds
Require master key authentication at the network layer (e.g. reverse proxy) for the GraphQL endpoint.
References
- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-q5q9-2rhp-33qw
- Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.10
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "parse-server"
},
"ranges": [
{
"events": [
{
"introduced": "9.3.1-alpha.3"
},
{
"fixed": "9.5.0-alpha.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-30854"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-09T17:42:17Z",
"nvd_published_at": "2026-03-07T17:15:52Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nWhen `graphQLPublicIntrospection` is disabled, `__type` queries nested inside inline fragments (e.g. `... on Query { __type(name:\"User\") { name } })` bypass the introspection control, allowing unauthenticated users to perform type reconnaissance. `__schema` introspection is not affected.\n\n### Patches\n\nThe check was changed from a flat iteration over root-level selections to a recursive walk of all selection sets, detecting `__type` inside inline fragments at any depth.\n\n### Workarounds\n\nRequire master key authentication at the network layer (e.g. reverse proxy) for the GraphQL endpoint.\n\n### References\n\n- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-q5q9-2rhp-33qw\n- Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.10",
"id": "GHSA-q5q9-2rhp-33qw",
"modified": "2026-03-09T17:42:17Z",
"published": "2026-03-09T17:42:17Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-q5q9-2rhp-33qw"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30854"
},
{
"type": "PACKAGE",
"url": "https://github.com/parse-community/parse-server"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled"
}
GHSA-Q5VH-6WHW-X745
Vulnerability from github – Published: 2021-08-13 20:16 – Updated: 2024-10-07 16:44Impact
Starting with OneFuzz 2.12.0 or greater, an incomplete authorization check allows an authenticated user from any Azure Active Directory tenant to make authorized API calls to a vulnerable OneFuzz instance.
To be vulnerable, a OneFuzz deployment must be:
* Version 2.12.0 or greater
* Deployed with the non-default --multi_tenant_domain option
This can result in read/write access to private data such as: * Software vulnerability and crash information * Security testing tools * Proprietary code and symbols
Via authorized API calls, this also enables tampering with existing data and unauthorized code execution on Azure compute resources.
Patches
This issue is resolved starting in release 2.31.0, via the addition of application-level check of the bearer token's issuer against an administrator-configured allowlist.
Workarounds
Users can restrict access to the tenant of a deployed OneFuzz instance < 2.31.0 by redeploying in the default configuration, which omits the --multi_tenant_domain option.
References
You can find an overview of the Microsoft Identity Platform here. This vulnerability applies to the multi-tenant application pattern, as described here.
For more information
If you have any questions or comments about this advisory: * Open an issue in OneFuzz * Email us at fuzzing@microsoft.com
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "onefuzz"
},
"ranges": [
{
"events": [
{
"introduced": "2.12.0"
},
{
"fixed": "2.31.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-37705"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-346",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-13T20:16:08Z",
"nvd_published_at": "2021-08-13T21:15:00Z",
"severity": "CRITICAL"
},
"details": "## Impact\n\nStarting with OneFuzz 2.12.0 or greater, an incomplete authorization check allows an authenticated user from any Azure Active Directory tenant to make authorized API calls to a vulnerable OneFuzz instance.\n\nTo be vulnerable, a OneFuzz deployment must be:\n* Version 2.12.0 or greater\n* Deployed with the non-default [`--multi_tenant_domain`](https://github.com/microsoft/onefuzz/blob/2.30.0/src/deployment/deploy.py#L1021) option\n\nThis can result in read/write access to private data such as:\n* Software vulnerability and crash information\n* Security testing tools\n* Proprietary code and symbols\n\nVia authorized API calls, this also enables tampering with existing data and unauthorized code execution on Azure compute resources.\n\n## Patches\n\nThis issue is resolved starting in release 2.31.0, via the addition of application-level check of the bearer token\u0027s `issuer` against an administrator-configured allowlist.\n\n## Workarounds\n\nUsers can restrict access to the tenant of a deployed OneFuzz instance \u003c 2.31.0 by redeploying in the default configuration, which omits the `--multi_tenant_domain` option.\n\n## References\n\nYou can find an overview of the Microsoft Identity Platform [here](https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-overview). This vulnerability applies to the multi-tenant application pattern, as described [here](https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-convert-app-to-be-multi-tenant).\n\n## For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [OneFuzz](https://github.com/microsoft/onefuzz)\n* Email us at [fuzzing@microsoft.com](mailto:fuzzing@microsoft.com)",
"id": "GHSA-q5vh-6whw-x745",
"modified": "2024-10-07T16:44:37Z",
"published": "2021-08-13T20:16:32Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/microsoft/onefuzz/security/advisories/GHSA-q5vh-6whw-x745"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37705"
},
{
"type": "WEB",
"url": "https://github.com/microsoft/onefuzz/pull/1153"
},
{
"type": "WEB",
"url": "https://github.com/microsoft/onefuzz/commit/2fcb4998887959b4fa11894a068d689189742cb1"
},
{
"type": "WEB",
"url": "https://github.com/microsoft/onefuzz"
},
{
"type": "WEB",
"url": "https://github.com/microsoft/onefuzz/releases/tag/2.31.0"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/onefuzz/PYSEC-2021-344.yaml"
},
{
"type": "WEB",
"url": "https://pypi.org/project/onefuzz"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L",
"type": "CVSS_V4"
}
],
"summary": "Improper Authorization and Origin Validation Error in OneFuzz"
}
GHSA-Q5XF-XHWF-CWQF
Vulnerability from github – Published: 2026-07-22 22:31 – Updated: 2026-07-22 22:31Impact
The OAuth 2.1 consent and token-issuance flow introduced in n8n 2.27.0 does not verify that the authenticated user has access to the workflow referenced as the OAuth resource. A member-level user can register an OAuth client, self-approve consent for another user's n8n OAuth2-protected MCP Server Trigger workflow, and obtain a valid token for it.
The workflow runs in the owner's project context with the owner's stored credentials. The attacker sets the tool inputs and reads the outputs, which may include data from the owner's connected integrations, breaking user and project isolation. The resulting executions appear under the owner's account and are not visible to the attacker.
This issue only affects instances running n8n 2.27.0 or later where at least one active workflow uses an MCP Server Trigger node configured with n8n OAuth2 authentication.
Patches
The issue has been fixed in n8n versions 2.29.8 and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Restrict n8n instance access to fully trusted users only.
- Audit active workflows using the MCP Server Trigger with n8n OAuth2 authentication and consider switching to a different authentication method or deactivating them until the patch is applied.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "n8n"
},
"ranges": [
{
"events": [
{
"introduced": "2.30.0"
},
{
"fixed": "2.30.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "n8n"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.29.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-65594"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-22T22:31:01Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Impact\nThe OAuth 2.1 consent and token-issuance flow introduced in n8n 2.27.0 does not verify that the authenticated user has access to the workflow referenced as the OAuth resource. A member-level user can register an OAuth client, self-approve consent for another user\u0027s `n8n OAuth2`-protected MCP Server Trigger workflow, and obtain a valid token for it.\n\nThe workflow runs in the owner\u0027s project context with the owner\u0027s stored credentials. The attacker sets the tool inputs and reads the outputs, which may include data from the owner\u0027s connected integrations, breaking user and project isolation. The resulting executions appear under the owner\u0027s account and are not visible to the attacker.\n\nThis issue only affects instances running n8n 2.27.0 or later where at least one active workflow uses an MCP Server Trigger node configured with `n8n OAuth2` authentication.\n\n## Patches\nThe issue has been fixed in n8n versions 2.29.8 and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Restrict n8n instance access to fully trusted users only.\n- Audit active workflows using the MCP Server Trigger with `n8n OAuth2` authentication and consider switching to a different authentication method or deactivating them until the patch is applied.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.",
"id": "GHSA-q5xf-xhwf-cwqf",
"modified": "2026-07-22T22:31:01Z",
"published": "2026-07-22T22:31:01Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-q5xf-xhwf-cwqf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65594"
},
{
"type": "PACKAGE",
"url": "https://github.com/n8n-io/n8n"
},
{
"type": "WEB",
"url": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.29.8"
},
{
"type": "WEB",
"url": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.30.1"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/n8n-before-missing-oauth-authorization-check"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "n8n: Member-Level Users Can Execute Other Users\u0027 MCP Server Trigger Workflows via Missing OAuth Authorization Check"
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.