N8N · GHSA-q8rc-7m84-mfvj · Package
FIX → 3.2.2 · 2.48.3 +1
n8n did not protect the instance owner account from users with a custom instance role that has user management permissions. Such a user can get a password reset link for the owner or change the owner's role, which gives full control of the instance.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted n8n instances that use the custom roles feature and have at least one custom instance role with user management permissions given to a user other than the owner. Instances on the fixed versions, or without custom instance roles, are not exposed. The sources do not say whether n8n Cloud was affected.
Not affected if default-roles-only, fixed-version
Who cares custom-roles, n8n, self-hosted
n8n --version or the package.json of your install; affected if below 2.47.6, 2.48.3 or 3.2.2 on the matching line.n8n protected the instance owner account from changes by every other user. The password reset link and role change operations did not apply that protection to users with a custom instance role. A user whose custom instance role included user management permissions could obtain a password reset link for the owner and take over the owner account, or change the owner's role. This gave the attacker full control of the instance.
Exploitation required the custom roles feature and a custom instance role with user management permissions assigned to the attacker.
The issue has been fixed in n8n versions 2.47.6, 2.48.3 and 3.2.2. Users should upgrade to one of these versions or later to remediate the vulnerability.
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to 3.2.2 · 2.48.3 +1
2.47.6 (2.47 line), 2.48.3 (2.48 line) or 3.2.2 (3.x line) or later.