An authorization flaw in n8n allows a user with the global role:manageProject scope to delete any custom project role, even when that role is in use. During deletion the code verifies only that the target role exists and is project‑scoped, but it omits the necessary project‑level authorization check. This flaw maps to CWE‑639: Permissions Mismatch. When the custom role is reassigned to the built‑in project:admin role, the attacker obtains full administrative control of any project they previously had no legitimate access to, enabling modification or deletion of project data and compromising both confidentiality and integrity.

The vulnerability exists in n8n after releases prior to 2.34.1, including version 2.33.4 and all earlier versions of the open‑source n8n platform distributed by n8n‑io.

The CVSS score of 7.4 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker only needs a user account that possesses the global role:manageProject scope; no additional privileges or network‑level access are required. By deleting a custom role and reassigning its holders—including themselves—to project:admin, the attacker bypasses all project‑level controls, gaining unchecked authority to modify or destroy project data.