Login Sign Up

CVE-2023-27563

8.8 HIGH
Authentication Bypass

📋 TL;DR

CVE-2023-27563 is a privilege escalation vulnerability in n8n workflow automation software that allows authenticated users to gain administrative privileges. This affects organizations using n8n for workflow automation where multiple user accounts exist. The vulnerability enables lower-privileged users to elevate their permissions to admin level.

💻 Affected Systems

Products:
  • n8n
Versions: 0.218.0
Operating Systems: All platforms running Node.js
Default Config Vulnerable: ⚠️ Yes
Notes: Only affects installations with multiple user accounts; single-user installations are not vulnerable to privilege escalation.

📦 What is this software?

N8n by N8n

View all CVEs affecting N8n →

⚠️ Risk & Real-World Impact

🔴

Worst Case

An authenticated attacker gains full administrative control over the n8n instance, potentially accessing sensitive workflow data, modifying automation logic, and compromising connected systems.

🟠

Likely Case

Internal users with standard permissions escalate to admin privileges, gaining unauthorized access to sensitive workflows and automation configurations.

🟢

If Mitigated

With proper access controls and monitoring, impact is limited to potential unauthorized access within the n8n application only.

🌐 Internet-Facing: HIGH
🏢 Internal Only: HIGH

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: LIKELY
Unauthenticated Exploit: ✅ No
Complexity: LOW

Exploitation requires authenticated access; technical details are publicly available in security advisories.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 0.218.1 and later

Vendor Advisory: https://github.com/n8n-io/n8n/releases

Restart Required: Yes

Instructions:

1. Backup your n8n instance. 2. Update n8n using npm: 'npm update n8n'. 3. Restart the n8n service. 4. Verify the version is 0.218.1 or higher.

🔧 Temporary Workarounds

Restrict User Access

all

Limit n8n access to trusted administrators only until patching is complete

Network Segmentation

all

Isolate n8n instance from sensitive systems and implement strict network controls

🧯 If You Can't Patch

  • Implement strict access controls and monitor all user activity within n8n
  • Consider temporarily disabling multi-user functionality if business requirements allow

🔍 How to Verify

Check if Vulnerable:

Check n8n version: if running version 0.218.0, the system is vulnerable

Check Version:

npx n8n --version or check package.json version

Verify Fix Applied:

Verify n8n version is 0.218.1 or higher and test user permission boundaries

📡 Detection & Monitoring

Log Indicators:

  • Unusual permission changes
  • Multiple admin privilege assignments
  • User role modification events

Network Indicators:

  • Unexpected API calls to user permission endpoints
  • Authentication anomalies

SIEM Query:

source="n8n" AND (event="user_role_change" OR event="permission_modification")

📊 Metadata

CVE ID: CVE-2023-27563
CVSS v3 Score: 8.8 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: May 10, 2023
Last Updated: January 27, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON