---
id: "GHSA-q8rc-7m84-mfvj"
page: "https://infrastack.ai/live/GHSA-q8rc-7m84-mfvj"
kind: "vulnerability"
aliases: ["GHSA-q8rc-7m84-mfvj"]
title: "Custom Instance Role with User Management Permissions Gives Control of the Owner Account"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "n8n", "fixed": ["2.48.3"], "affected": "< 2.48.3", "ecosystem": "npm"}, {"name": "n8n", "fixed": ["2.47.6"], "affected": "< 2.47.6", "ecosystem": "npm"}, {"name": "n8n", "fixed": ["3.2.2"], "affected": "< 3.2.2", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["custom-roles", "n8n", "package", "self-hosted"]
not_affected_if: ["default-roles-only", "fixed-version"]
published_at: "2026-11-13T10:55:27+00:00"
first_seen_at: "2026-11-13T11:06:24+00:00"
updated_at: "2026-11-13T11:06:57+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-q8rc-7m84-mfvj", "first_seen_at": "2026-11-13T11:06:24+00:00"}]
exploit_sources: []
---

# Custom Instance Role with User Management Permissions Gives Control of the Owner Account

Link for people: https://infrastack.ai/live/GHSA-q8rc-7m84-mfvj (this .md is for agents)

n8n did not protect the instance owner account from users with a custom instance role that has user management permissions. Such a user can get a password reset link for the owner or change the owner's role, which gives full control of the instance.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:n8n affected < 2.48.3 fixed 2.48.3
- npm:n8n affected < 2.47.6 fixed 2.47.6
- npm:n8n affected < 3.2.2 fixed 3.2.2

## How to check

- Check the n8n version with `n8n --version` or the package.json of your install; affected if below `2.47.6`, `2.48.3` or `3.2.2` on the matching line.
- In the n8n admin settings, list custom instance roles and look for any with user management permissions assigned to non-owner users.
- Exploitation requires the custom roles feature enabled.

## Fix

- Upgrade n8n to `2.47.6` (2.47 line), `2.48.3` (2.48 line) or `3.2.2` (3.x line) or later.
- Workaround until upgrade: remove user management permissions from custom instance roles held by users who are not fully trusted, and enable two-factor authentication on the owner account. The sources say these do not fully remediate the risk.

## Timeline

- 2026-11-13T11:06:24+00:00 ghsa-repo https://github.com/n8n-io/n8n/security/advisories/GHSA-q8rc-7m84-mfvj

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/n8n-io/n8n/security/advisories/GHSA-q8rc-7m84-mfvj

## From the sources

## Impact

n8n protected the instance owner account from changes by every other user. The password reset link and role change operations did not apply that protection to users with a custom instance role. A user whose custom instance role included user management permissions could obtain a password reset link for the owner and take over the owner account, or change the owner's role. This gave the attacker full control of the instance.

Exploitation required the custom roles feature and a custom instance role with user management permissions assigned to the attacker.

## Patches

The issue has been fixed in n8n versions 2.47.6, 2.48.3 and 3.2.2. Users should upgrade to one of these versions or later to remediate the vulnerability.

## Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Restrict n8n instance access to fully trusted users only.
- Remove user management permissions from custom instance roles assigned to users who are not fully trusted.
- Enable two-factor authentication on the owner account.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_