A flaw in the LDAP authentication configuration of the n8n platform allows a user who can control their own LDAP email attribute to match the email of another account, including administrators. When the email values coincide, n8n automatically links the LDAP identity to the existing local account, granting the attacker full access to that account. The linkage persists even after the email is changed back, resulting in a permanent takeover. This results in unauthorized privilege escalation and full control over the victim account.

Vendors n8n‑io, product n8n (open‑source workflow automation platform). Versions prior to 2.4.0 and 1.121.0 are vulnerable; later releases contain the fix.

The vulnerability scores 8.8 on CVSS, indicating high severity. Exploitation requires the attacker to be authenticated to the LDAP directory and have permission to modify the email attribute of their own LDAP entry. Once those conditions are met, the attacker can quickly link to any target account with a matching email. The flaw is not already present in the CISA KEV catalog and EPSS data is unavailable, but the attack path is straightforward and the impact is severe, warranting immediate attention.