The vulnerability originates from the enterprise SSO instance‑role provisioning path in n8n. When an IdP asserts a role claim, the logic maps that claim directly to an n8n global role. Unlike the token‑exchange identity path, this mapping does not block the elevation to the global:owner role. An attacker who can influence the instance‑role claim value received from the IdP can cause the system to grant the global:owner role. This results in full administrative control over workflows, credentials, users, and instance configuration. The weakness is a failure to enforce least‑privilege authority mapping (CWE‑639).

Vendors affected include n8n‑io and its n8n product. All versions prior to 1.123.64, 2.29.8, and 2.30.1 are impacted. The issue exists only when Enterprise SSO is configured and instance‑role provisioning is enabled (via the N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE setting, which is disabled by default).

The CVSS score of 7.7 indicates high severity. EPSS score is less than 1%, indicating a very low exploitation probability, yet the threat remains significant because the attack requires an attacker to control the instance‑role claim issued by the IdP, which may be achieved by compromising the identity provider or influencing claim generation. The vulnerability is not listed in the CISA KEV catalog. Attacks would involve SSO authentication flows; hence the likely attack vector is through the enterprise SSO integration. The risk remains high if Enterprise SSO is in use and provisioning is enabled, while it is lower or mitigated if those features are disabled or properly secured.