CVE-2026-72541

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the update_resource_type endpoint. The endpoint omits the administrator permission check that the corresponding delete_resource_type endpoint enforces. An attacker with workspace member privileges can corrupt resource type definitions, breaking workflows that depend on them.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/windmill-labs/windmill

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad por falta de autorización en Windmill Labs Windmill hasta la versión 1.783.0 permite a cualquier miembro autenticado del espacio de trabajo sobrescribir cualquier esquema de tipo de recurso a través del endpoint update_resource_type. El endpoint omite la verificación de permisos de administrador que el endpoint delete_resource_type correspondiente aplica. Un atacante con privilegios de miembro del espacio de trabajo puede corromper las definiciones de tipo de recurso, rompiendo los flujos de trabajo que dependen de ellas.

Information

Published : 2026-08-11 12:17

Updated : 2026-10-24 15:10

NVD link : CVE-2026-72541

Mitre link : CVE-2026-72541

CVE.ORG link : CVE-2026-72541

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-72541", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72541", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T12:34:35.266216Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "affectedData": [{"vendor": "Windmill Labs", "product": "Windmill", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.783.0"}]}]}], "published": "2026-08-11T12:17:39.470", "references": [{"url": "https://github.com/windmill-labs/windmill", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the update_resource_type endpoint. The endpoint omits the administrator permission check that the corresponding delete_resource_type endpoint enforces. An attacker with workspace member privileges can corrupt resource type definitions, breaking workflows that depend on them."}, {"lang": "es", "value": "Una vulnerabilidad por falta de autorizaci\u00f3n en Windmill Labs Windmill hasta la versi\u00f3n 1.783.0 permite a cualquier miembro autenticado del espacio de trabajo sobrescribir cualquier esquema de tipo de recurso a trav\u00e9s del endpoint update_resource_type. El endpoint omite la verificaci\u00f3n de permisos de administrador que el endpoint delete_resource_type correspondiente aplica. Un atacante con privilegios de miembro del espacio de trabajo puede corromper las definiciones de tipo de recurso, rompiendo los flujos de trabajo que dependen de ellas."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}