CVE-2026-77079: Authorization Bypass Through User-Controlled Key

n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion reassignment path. When deleting a custom project role with a reassignment target, the code validated only that the target role existed and was project-scoped, performing no project-level authorizati...