CVE-2026-72541

MEDIUM 6.5

Windmill Labs Windmill - Missing Authorization

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the update_resource_type endpoint. The endpoint omits the administrator permission check that the corresponding delete_resource_type endpoint enforces. An attacker with workspace member privileges can corrupt resource type definitions, breaking workflows that depend on them.

CWE	CWE-306
Vendor	windmill labs
Product	windmill
Published	Aug 11, 2026
Last Updated	Aug 11, 2026

Stay Ahead of the Next One

Get instant alerts for windmill labs windmill

Be the first to know when new medium vulnerabilities affecting windmill labs windmill are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Windmill Labs / Windmill

0 ≤ 1.783.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/windmill-labs/windmill

Credits

Bobur Abdugafforov (Mahadsec)