CyberRota Analysis
AI-GeneratedThe vulnerability affects the n8n workflow automation platform, specifically in the role management endpoints that fail to enforce proper access controls, allowing users with the role:manageProject permission to access member names and email addresses of projects they cannot list. This could lead to unauthorized information disclosure, posing a risk to user privacy and data security. Organizations using versions prior to 2.37.7 and 2.38.2 should prioritize applying the updates to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members endpoints checked only whether the caller could manage the role type. A caller with role:manageProject could name a project the caller could not list and obtain member names and email addresses. The affected controller is packages/cli/src/controllers/role.controller.ts, which omitted the project:list scope check. This issue is fixed in versions 2.37.7 and 2.38.2.
Related CVEs
Other vulnerabilities affecting the same vendor(s)