CVE-2026-72542
Windmill Labs Windmill - Missing Authorization
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write job progress and read job metrics for any job in the workspace regardless of ownership. The job_metrics handlers accept no authorization extractor, bypassing workspace-level access controls. An operator can monitor sensitive job execution data and inject misleading progress for jobs they do not own.
| CWE | CWE-306 |
| Vendor | windmill labs |
| Product | windmill |
| Published | Aug 11, 2026 |
| Last Updated | Aug 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for windmill labs windmill
Be the first to know when new medium vulnerabilities affecting windmill labs windmill are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Windmill Labs / Windmill
0 ≤ 1.783.0
Credits
Bobur Abdugafforov (Mahadsec)