CVE-2026-72539

{"id": "CVE-2026-72539", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72539", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T12:36:04.110884Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "affectedData": [{"vendor": "Windmill Labs", "product": "Windmill", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.783.0"}]}]}], "published": "2026-08-11T12:17:39.220", "references": [{"url": "https://github.com/windmill-labs/windmill", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that contain plaintext resource credentials. Drafts with a null owner email bypass ACL enforcement and are returned to any workspace member who queries the drafts endpoint. Sensitive credentials stored in these drafts are exposed across ACL boundaries."}, {"lang": "es", "value": "Una vulnerabilidad de revelaci\u00f3n de informaci\u00f3n en Windmill Labs Windmill hasta la versi\u00f3n 1.783.0 permite a cualquier miembro autenticado del espacio de trabajo leer scripts de borrador heredados sin propietario que contienen credenciales de recursos en texto plano. Los borradores con un correo electr\u00f3nico de propietario nulo eluden la aplicaci\u00f3n de ACL y se devuelven a cualquier miembro del espacio de trabajo que consulta el endpoint de borradores. Las credenciales sensibles almacenadas en estos borradores quedan expuestas a trav\u00e9s de los l\u00edmites de ACL."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}