PT-2026-66575

Name of the Vulnerable Software and Affected Versions Spikster versions prior to commit e1cdf8c Description A missing authentication flaw allows unauthenticated remote attackers to access all API routes. This occurs because the CipiAuth middleware is registered but not applied to any route within...

CVE-2026-66015

CVE-2026-66015 /JFrog Platform: An authenticated privilege-escalation via an authorization flaw under admin-provisioned accounts could grant temporary platform administrator access. Documented as an authenticated threat with HIGH impact (confidentiality, integrity, availability). No specific expl...

NPM: n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner

NPM: n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner vulnerability discovered by ? in WordPress Npm n8n versions 1.123.64...

n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner

Impact n8n's Enterprise SSO instance-role provisioning maps a role claim asserted by the configured Identity Provider IdP to an n8n global role and applies it during authentication. The provisioning path did not prevent assignment of the global:owner role, unlike the token-exchange identity path,...

Authorization Bypass Through User-Controlled Key

Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the SSO instance-role provisioning. An attacker can gain full administrative privileges by manipulating the instance-role claim issued by the...

GHSA-35Q8-9MJ6-WJMF n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner

Impact n8n's Enterprise SSO instance-role provisioning maps a role claim asserted by the configured Identity Provider IdP to an n8n global role and applies it during authentication. The provisioning path did not prevent assignment of the global:owner role, unlike the token-exchange identity path,...

GHSA-MWQ7-VCMC-CM4Q Duplicate Advisory: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-35q8-9mj6-wjmf. This link is maintained to preserve external references. Original Description n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO...

Duplicate Advisory: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-35q8-9mj6-wjmf. This link is maintained to preserve external references. Original Description n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO...

CVE-2026-65016

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role unlike the token-exchang...

CVE-2026-65016 n8n before 1.123.64, 2.29.8, and 2.30.1 Privilege Escalation via SSO Instance-Role

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role unlike the token-exchang...

CVE-2026-65016

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role unlike the token-exchang...

CVE-2026-65016

CVE-2026-65016 affects n8n versions before 1.123.64, 2.29.8, and 2.30.1. The issue lies in Enterprise SSO instance-role provisioning: the IdP-asserted role claim is mapped to an n8n global role without preventing assignment of the global:owner role. Consequently, an SSO-authenticated user whose i...

EUVD-2026-47632

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role unlike the token-exchang...

CVE-2026-65016 n8n before 1.123.64, 2.29.8, and 2.30.1 Privilege Escalation via SSO Instance-Role

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role unlike the token-exchang...

CVE-2026-65016 n8n before 1.123.64, 2.29.8, and 2.30.1 Privilege Escalation via SSO Instance-Role

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role unlike the token-exchang...

CVE-2026-65016: Authorization Bypass Through User-Controlled Key

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role unlike the token-exchang...

PT-2026-63346

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role unlike the token-exchang...

CVE-2026-61143

Vulnerability in the Oracle Communications Convergent Charging Controller product of Oracle Communications component: Prov IF. Supported versions that are affected are 15.0.0.0.0 and 15.2.0.0.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to...

CVE-2026-10675

In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer subsys/bluetooth/mesh/pbadv.c, provmsgrecv rescheduled the provisioning protocol watchdog timer unconditionally at the top of the function, before the FCS check and before the ADVLINKINVALID check. Once a provisioning attempt fails, provfailed...

CVE-2026-10675 Bluetooth Mesh PB-ADV: invalidated provisioning link kept alive indefinitely, blocking (re)provisioning (DoS)

In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer subsys/bluetooth/mesh/pbadv.c, provmsgrecv rescheduled the provisioning protocol watchdog timer unconditionally at the top of the function, before the FCS check and before the ADVLINKINVALID check. Once a provisioning attempt fails, provfailed...