{"uuid": "c1a5adc2-3600-446b-918b-e4d8c7ac245c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56350", "type": "seen", "source": "https://gist.github.com/alon710/8dfa8b639d7c92db923d54e0e8243293", "content": "# CVE-2026-56350: CVE-2026-56350: SSO Enforcement Bypass in n8n via API Parameter Pollution / Mass Assignment\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-06-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-56350\n\n## Summary\nA mass assignment vulnerability (CWE-915) in n8n's self-service settings API endpoint (PATCH /me/settings) allows authenticated Single Sign-On (SSO) users to disable SSO enforcement for their accounts by injecting administrative parameters. This bypasses organizational identity provider controls and multi-factor authentication (MFA).\n\n## TL;DR\nAuthenticated SSO users can bypass SSO enforcement and log in with email/password credentials by exploiting a mass assignment flaw in n8n's settings endpoint.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-285, CWE-915\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 6.3 (Medium)\n- **CVSS v4.0 Score**: 6.0 (Medium)\n- **Exploit Status**: PoC / Simulated\n- **CISA KEV Status**: Not Listed\n- **Remediation Status**: Patched in v2.8.0\n\n## Affected Systems\n\n- n8n (npm package)\n- **n8n**: < 2.8.0 (Fixed in: `2.8.0`)\n\n## Mitigation\n\n- Upgrade n8n deployment to version 2.8.0 or newer to enforce strict schema separation.\n- Regularly audit the underlying database for anomalous SSO bypass configuration flags on standard user accounts.\n- Implement perimeter API rules using a Web Application Firewall (WAF) to detect or block unauthorized settings modifications.\n\n**Remediation Steps:**\n1. Identify all current n8n container or platform instances in production.\n2. Modify deployment configuration files (such as docker-compose.yml) to target tag 2.8.0 or higher.\n3. Perform a rolling deployment to update the active application bin.\n4. Run the diagnostic database query to verify if any accounts contain manual settings bypass flags: SELECT id, email, settings FROM \"user\" WHERE settings::jsonb ->> 'allowSSOManualLogin' = 'true';\n5. If matching records are found, reset the database field and review session logs for unauthorized activity on those accounts.\n\n## References\n\n- [GitHub Security Advisory GHSA-vjf3-2gpj-233v](https://github.com/n8n-io/n8n/security/advisories/GHSA-vjf3-2gpj-233v)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/n8n-sso-enforcement-bypass-via-api)\n- [Fix Commit](https://github.com/n8n-io/n8n/commit/a70b2ea379086da3de103bb84811e88cadf29976)\n- [n8n Release v2.8.0](https://github.com/n8n-io/n8n/releases/tag/n8n@2.8.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-56350) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-06T07:59:30.801200Z"}