Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-22683— Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE

Quick assessment

Affected
Windmill Labs Windmill CE (Community Edition)
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Windmill是Windmill Labs, Inc开源的一个低代码开发平台。 Windmill 1.56.0至1.614.0版本存在安全漏洞，该漏洞源于缺少授权，可能导致具有Operator角色的用户执行禁止的实体创建和修改操作，从而实现权限提升和远程代码执行。

CVSS 8.8 · High EPSS 2.61% · P85

Public Exploits 1

Nuclei · 1 CVE-2026-22683.yaml [template]

Affected Version Matrix 4

VendorProduct Version RangeStatus
Windmill Labs Windmill CE (Community Edition) 1.56.0≤ 1.614.0 affected
1.615.0 unaffected
Windmill Labs Windmill EE (Enterprise Edition) 1.56.0≤ 1.614.0 affected
1.615.0 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-22683

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE
Source: CVE Program / CVE List V5
Vulnerability Description
Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities, the API does not enforce the Operator restriction on workspace endpoints, allowing an Operator to create and update scripts, flows, apps, and raw_apps. Since Operators can also execute scripts via the jobs API, this allows direct privilege escalation to remote code execution within the Windmill deployment. This vulnerability has existed since the introduction of the Operator role in version 1.56.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
Windmill 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Windmill是Windmill Labs, Inc开源的一个低代码开发平台。 Windmill 1.56.0至1.614.0版本存在安全漏洞，该漏洞源于缺少授权，可能导致具有Operator角色的用户执行禁止的实体创建和修改操作，从而实现权限提升和远程代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Windmill Labs Windmill CE (Community Edition) 1.56.0 ~ 1.614.0 -
Windmill Labs Windmill EE (Enterprise Edition) 1.56.0 ~ 1.614.0 -

II. Public POCs for CVE-2026-22683

# POC Description Source Link Shenlong Link
1 Windmill versions 1.276.0 through 1.603.2 contain an authorization bypass vulnerability in the folder management API endpoints. The endpoints for creating, deleting, and managing folder ownership do not enforce role-based access control for operator-level users. In Windmill, operators are restricted users intended to only execute existing scripts, but due to missing server-side authorization checks, operators can create folders, manage folder permissions, and access owner management endpoints. This bypass serves as the prerequisite for exploiting CVE-2026-23696 (SQL injection via folder addowner) enabling full privilege escalation from operator to super admin with remote code execution. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-22683.yaml POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-22683

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-22683 (1)

Exploits & Public PoCs for CVE-2026-22683 (1)

Other References for CVE-2026-22683 (1)

IV. Related Vulnerabilities

Same product: Windmill CE (Community Edition)
Same vendor: Windmill Labs
Same weakness: CWE-862

V. Comments for CVE-2026-22683

No comments yet

Leave a comment