An authenticated LDAP user can alter their own LDAP email attribute to match the email of any local account in n8n. When the LDAP email matches an existing local account’s email, n8n automatically links the LDAP identity to that account. The attacker then logs in and gains full access to the target account, potentially an administrator. The link persists even after the email attribute is changed back, resulting in a permanent takeover. This flaw is an authentication bypass and account takeover weakness (CWE‑287).

The vulnerability affects the n8n open‑source workflow platform from n8n‑io. All releases before version 2.4.0 in the 2.x line and before 1.121.0 in the 1.x line are impacted when LDAP authentication is enabled. Instances that have LDAP authentication disabled are not susceptible.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests it has not yet been widely exploited and it is not listed in the CISA KEV catalog. Exploitation requires an authenticated LDAP user who can edit their own email attribute, enabling the attacker to link their identity to any local account. The attack path is simple: change the LDAP email to an existing user’s, log in, and assume that user’s privileges. Because the link remains after the email change, the compromise is permanent until remedied.