Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-72541: Windmill lets any team member change workflow templates

CVE-2026-72541 · published 2 months ago

Summary

In Windmill versions up to 1.783.0, a logged‑in team member can modify any workflow definition using the update feature. This can corrupt the definitions that drive automated tasks, causing those processes to stop working. Apply the latest Windmill update and ensure only administrators have permission to edit workflow templates.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
windmill labs	windmill	<= 1.783.0

Original advisory text

Windmill Labs Windmill - Missing Authorization

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the update_resource_type endpoint. The endpoint omits the administrator permission check that the corresponding delete_resource_type endpoint enforces. An attacker with workspace member privileges can corrupt resource type definitions, breaking workflows that depend on them.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72541... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-72541 Vendor Advisory
https://github.com/windmill-labs/windmill Product

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-306Missing Authentication for Critical Function

Timeline

Published11 Aug 2026

Updated31 Oct 2026

First seen11 Aug 2026

Sources

CVE-2026-72541 · NVD

CVE-2026-72541 · MITRE

CVE-2026-72541 · OSV

Track software like this

Free during beta