---
id: CVE-2026-118649
title: >-
  n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in
  Data Tables
summary: >-
  n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow
  ID and caches each workflow's owner project in memory by that ID, so a crafted
  ID such as __proto__ makes the Data Table project check match every project.
  An …
severity: high
cvss: 8.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L'
cvssSource: cna
cwe:
  - CWE-1321
vendor: n8n-io
product: n8n
affected:
  - n8n >= 2.44.0 < 2.44.1
  - n8n < 2.43.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-29T15:36:46.048286Z'
published: '2026-10-28'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T20:54:35.672Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118649'
references:
  - url: 'https://github.com/n8n-io/n8n/security/advisories/GHSA-wvjj-qg37-pv73'
    label: GitHub Security Advisory (GHSA-wvjj-qg37-pv73)
  - url: >-
      https://www.vulncheck.com/advisories/n8n-before-2.43.5-and-2.44.1-authorization-bypass-via-crafted-workflow-id-in-data-tables
    label: >-
      VulnCheck Advisory: n8n before 2.43.5 and 2.44.1 Authorization Bypass via
      Crafted Workflow ID in Data Tables
tags:
  - cve.org
epss: 0.0027
epssPercentile: 0.19244
ingestedAt: '2026-10-29T15:37:07.544Z'
---

## Overview

n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner project in memory by that ID, so a crafted ID such as __proto__ makes the Data Table project check match every project. An authenticated member who can create and run workflows can list, read, modify, and delete Data Table rows in all projects of the instance.

## Affected

- `n8n >= 2.44.0 < 2.44.1`
- `n8n < 2.43.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.