n8n Broken Object-Level Authorization on Role Assignment Endpoints Leaks Cross-Tenant Project Member PII

Technical Analysis

The vulnerable routes, /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members, authorized requests solely on the caller's role-management scope (e.g. role:manageProject) without a second check confirming the caller has visibility into the specific project supplied as a parameter. This is a classic broken object-level authorization (BOLA/IDOR) pattern: the authorization check validates the action type but not the target object's ownership or tenant boundary. An attacker with any role-management permission could supply arbitrary project identifiers and receive back member lists containing PII (names, emails) for projects they should not be able to see, effectively crossing tenant/workspace trust boundaries within a shared n8n instance. While this is not an AI-agent-specific exploit, n8n is widely used to orchestrate AI agent workflows and connect LLM tools/credentials across teams, so leaked project membership data could be leveraged for social engineering, credential targeting, or further reconnaissance against agent-connected automation pipelines.

Affected Systems

n8n

Detection Signatures

• Unusual sequential or enumerated requests to /rest/roles/:slug/assignments/:projectId/members with varying projectId values
• Requests to role-assignment endpoints from users without corresponding project membership
• High-volume calls to /rest/roles/*/assignments* from a single account across many distinct project IDs
• Audit logs showing role:manageProject scope usage disjoint from actual project ownership

Remediation Steps

1. 1

   Upgrade n8n

   Update to n8n 2.38.2, 2.37.7, or later where the patch enforces a per-project access check on both role-assignment endpoints.

2. 2

   Restrict role:manageProject scope

   Audit custom global roles and limit any role carrying role:manageProject to fully trusted administrators only, until the upgrade is applied.

3. 3

   Limit instance access

   Restrict n8n instance access to trusted users and enforce least-privilege role assignments as a temporary compensating control.

4. 4

   Review access logs

   Audit historical API calls to /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members for cross-project enumeration prior to patching.