EUVD-2026-74271

n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints...

CVE-2026-77079: Authorization Bypass Through User-Controlled Key

n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion reassignment path. When deleting a custom project role with a reassignment target, the code validated only that the target role existed and was project-scoped, performing no project-level authorizati...