N8N · GHSA-m7qq-gm3x-v79g · AI agents & MCP
FIX → 2.14.0 · 1.123.90
n8n's invitation acceptance endpoint accepted user IDs without a signed invitation token, so a member who can list users can set the password of a pending account. The attacker can then log in as that user, or as an admin if the pending invitation had the admin role.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted n8n instances where users can be invited and where some members can list users. The flaw needs an invitation that has not yet been accepted, so instances with no pending invitations have less exposure. Hosted n8n instances run by the vendor are not the team's concern, and teams on patched versions can skip it.
Not affected if managed-hosting, no-pending-invitations
Who cares automation, n8n, self-hosted
npm ls n8n or n8n --version; versions below 1.123.90 on the 1.x line or below 2.14.0 on the 2.x line are affected.Upgrade to 2.14.0 · 1.123.90
n8n let an invited user set up their account through the invitation acceptance endpoint. The endpoint accepted any inviter and invitee user IDs without a signed invitation token. A member with permission to list users could read the ID of a pending account and set its password without authentication. They could then log in as that user, with its project access, or as an admin when the pending invitation had the admin role.
Exploitation required an invitation that had not been accepted yet.
The issue has been fixed in n8n versions 1.123.90 and 2.14.0. Users should upgrade to one of these versions or later to remediate the vulnerability.
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
1.123.90 on the 1.x line.2.14.0 on the 2.x line.