{"id":"GHSA-q8rc-7m84-mfvj","kind":"vulnerability","aliases":["GHSA-q8rc-7m84-mfvj"],"related":[],"title":"Custom Instance Role with User Management Permissions Gives Control of the Owner Account","description":"## Impact\n\nn8n protected the instance owner account from changes by every other user. The password reset link and role change operations did not apply that protection to users with a custom instance role. A user whose custom instance role included user management permissions could obtain a password reset link for the owner and take over the owner account, or change the owner's role. This gave the attacker full control of the instance.\n\nExploitation required the custom roles feature and a custom instance role with user management permissions assigned to the attacker.\n\n## Patches\n\nThe issue has been fixed in n8n versions 2.47.6, 2.48.3 and 3.2.2. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\n\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Restrict n8n instance access to fully trusted users only.\n- Remove user management permissions from custom instance roles assigned to users who are not fully trusted.\n- Enable two-factor authentication on the owner account.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","summary":"n8n did not protect the instance owner account from users with a custom instance role that has user management permissions. Such a user can get a password reset link for the owner or change the owner's role, which gives full control of the instance.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"n8n","fixed":["2.48.3"],"affected":"< 2.48.3","ecosystem":"npm"},{"name":"n8n","fixed":["2.47.6"],"affected":"< 2.47.6","ecosystem":"npm"},{"name":"n8n","fixed":["3.2.2"],"affected":"< 3.2.2","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["custom-roles","n8n","package","self-hosted"],"not_affected_if":["default-roles-only","fixed-version"],"how_to_check":"- Check the n8n version with `n8n --version` or the package.json of your install; affected if below `2.47.6`, `2.48.3` or `3.2.2` on the matching line.\n- In the n8n admin settings, list custom instance roles and look for any with user management permissions assigned to non-owner users.\n- Exploitation requires the custom roles feature enabled.","fix":"- Upgrade n8n to `2.47.6` (2.47 line), `2.48.3` (2.48 line) or `3.2.2` (3.x line) or later.\n- Workaround until upgrade: remove user management permissions from custom instance roles held by users who are not fully trusted, and enable two-factor authentication on the owner account. The sources say these do not fully remediate the risk.","status":"open","published_at":"2026-11-13T10:55:27+00:00","first_seen_at":"2026-11-13T11:06:24+00:00","triaged_at":"2026-11-13T11:06:57+00:00","updated_at":"2026-11-13T11:06:57+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T11:06:57Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade n8n to `2.47.6` (2.47 line), `2.48.3` (2.48 line) or `3.2.2` (3.x line) or later.\n- Workaround until upgrade: remove user management permissions from custom instance roles held by users who are not fully trusted, and enable two-factor authentication on the owner account. The sources say these do not fully remediate the risk.","reach":"network","title":"n8n: custom instance role can take over the owner account","impact":"high","summary":"n8n did not protect the instance owner account from users with a custom instance role that has user management permissions. Such a user can get a password reset link for the owner or change the owner's role, which gives full control of the instance.","audience":"developers","category":"package","nicknames":[],"who_cares":["n8n","self-hosted","custom-roles"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"attacker takes over the owner account and full instance control","analyst_note":"","how_to_check":"- Check the n8n version with `n8n --version` or the package.json of your install; affected if below `2.47.6`, `2.48.3` or `3.2.2` on the matching line.\n- In the n8n admin settings, list custom instance roles and look for any with user management permissions assigned to non-owner users.\n- Exploitation requires the custom roles feature enabled.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-roles-only","fixed-version"],"who_is_affected":"Self-hosted n8n instances that use the custom roles feature and have at least one custom instance role with user management permissions given to a user other than the owner. Instances on the fixed versions, or without custom instance roles, are not exposed. The sources do not say whether n8n Cloud was affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000818,"input_tokens":4922,"output_tokens":652,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'2.47.6':181C '2.48.3':182C '3.2.2':184C '7m84':17A,22A 'access':216C 'account':13A,42B,86C,137C,246C 'administr':206C 'appli':103C 'assign':168C,230C 'attack':147C,171C 'authent':242C 'chang':68B,88C,99C,139C 'consid':208C 'control':9A,76B,149C 'could':123C 'custom':1A,28B,47B,110C,116C,156C,161C,227C 'custom-rol':27B 'enabl':238C 'everi':90C 'exploit':153C 'factor':241C 'featur':158C 'fix':177C 'follow':210C 'full':75B,148C 'fulli':218C,236C,251C 'gave':145C 'get':59B 'ghsa':15A,20A 'ghsa-q8rc-7m84-mfvj':14A,19A 'give':8A,74B 'host':34B 'immedi':204C 'impact':80C 'includ':119C 'instanc':2A,40B,48B,79B,84C,111C,117C,152C,162C,215C,228C 'issu':174C 'later':194C 'link':63B,96C,128C 'manag':6A,53B,121C,166C,224C 'measur':265C 'mfvj':18A,23A 'mitig':212C,264C 'n8n':24A,25A,26A,30B,35B,81C,179C,214C 'obtain':124C 'one':189C 'oper':100C 'owner':12A,41B,66B,70B,85C,131C,136C,141C,245C 'packag':31B 'password':61B,94C,126C 'patch':172C 'permiss':7A,54B,122C,167C,225C 'possibl':205C 'protect':38B,82C,105C 'q8rc':16A,21A 'remedi':196C,252C 'remov':222C 'requir':154C 'reset':62B,95C,127C 'restrict':213C 'risk':254C 'role':3A,29B,49B,72B,98C,112C,118C,143C,157C,163C,229C 'self':33B 'self-host':32B 'short':262C 'short-term':261C 'take':133C 'temporari':211C 'term':263C 'trust':219C,237C 'two':240C 'two-factor':239C 'upgrad':187C,201C 'use':259C 'user':5A,44B,52B,57B,92C,107C,114C,120C,165C,185C,220C,223C,232C 'version':180C,192C 'vulner':198C 'whose':115C 'workaround':199C,248C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted n8n instances that use the custom roles feature and have at least one custom instance role with user management permissions given to a user other than the owner. Instances on the fixed versions, or without custom instance roles, are not exposed. The sources do not say whether n8n Cloud was affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["n8n"],"ptokens":["n8n"],"labels":["customroles","high","n8n","npm","package","selfhosted"],"campaign_type":null,"search_a":"'7m84':17A,22A 'account':13A 'control':9A 'custom':1A 'ghsa':15A,20A 'ghsa-q8rc-7m84-mfvj':14A,19A 'give':8A 'instanc':2A 'manag':6A 'mfvj':18A,23A 'n8n':24A,25A,26A 'owner':12A 'permiss':7A 'q8rc':16A,21A 'role':3A 'user':5A","search_b":"'account':42B 'chang':68B 'control':76B 'custom':28B,47B 'custom-rol':27B 'full':75B 'get':59B 'give':74B 'host':34B 'instanc':40B,48B,79B 'link':63B 'manag':53B 'n8n':30B,35B 'owner':41B,66B,70B 'packag':31B 'password':61B 'permiss':54B 'protect':38B 'reset':62B 'role':29B,49B,72B 'self':33B 'self-host':32B 'user':44B,52B,57B","search_c":"'2.47.6':181C '2.48.3':182C '3.2.2':184C 'access':216C 'account':86C,137C,246C 'administr':206C 'appli':103C 'assign':168C,230C 'attack':147C,171C 'authent':242C 'chang':88C,99C,139C 'consid':208C 'control':149C 'could':123C 'custom':110C,116C,156C,161C,227C 'enabl':238C 'everi':90C 'exploit':153C 'factor':241C 'featur':158C 'fix':177C 'follow':210C 'full':148C 'fulli':218C,236C,251C 'gave':145C 'immedi':204C 'impact':80C 'includ':119C 'instanc':84C,111C,117C,152C,162C,215C,228C 'issu':174C 'later':194C 'link':96C,128C 'manag':121C,166C,224C 'measur':265C 'mitig':212C,264C 'n8n':81C,179C,214C 'obtain':124C 'one':189C 'oper':100C 'owner':85C,131C,136C,141C,245C 'password':94C,126C 'patch':172C 'permiss':122C,167C,225C 'possibl':205C 'protect':82C,105C 'remedi':196C,252C 'remov':222C 'requir':154C 'reset':95C,127C 'restrict':213C 'risk':254C 'role':98C,112C,118C,143C,157C,163C,229C 'short':262C 'short-term':261C 'take':133C 'temporari':211C 'term':263C 'trust':219C,237C 'two':240C 'two-factor':239C 'upgrad':187C,201C 'use':259C 'user':92C,107C,114C,120C,165C,185C,220C,223C,232C 'version':180C,192C 'vulner':198C 'whose':115C 'workaround':199C,248C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T10:55:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-q8rc-7m84-mfvj","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-q8rc-7m84-mfvj","severity":"high","published_at":"2026-11-13T10:55:27+00:00","modified_at":"2026-11-13T10:55:27+00:00","first_seen_at":"2026-11-13T11:06:24+00:00","fetched_at":"2026-11-13T11:06:24+00:00","note":null}],"documents":[{"id":145548,"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-q8rc-7m84-mfvj","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}