CVE-2026-72541— Windmill Labs Windmill - Missing Authorization
Quick assessment
Affected
Windmill Labs Windmill
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Windmill Labs Windmill是Windmill Labs组织的一款可构建内部工具与自动化工作流的软件平台。 Windmill Labs Windmill 1.783.0及之前版本存在授权问题漏洞，该漏洞源于update_resource_type端点缺少管理员权限检查，可能导致已认证的工作区成员覆盖任意资源类型schema，破坏资源类型定义，中断依赖它们的工作流。
Possible ATT&CK Techniques 2 AI
T1498 · Network Denial of Service T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Windmill Labs | Windmill | ≤ 1.783.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-72541
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Windmill Labs Windmill - Missing Authorization
Source: CVE Program / CVE List V5
Vulnerability Description
A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the update_resource_type endpoint. The endpoint omits the administrator permission check that the corresponding delete_resource_type endpoint enforces. An attacker with workspace member privileges can corrupt resource type definitions, breaking workflows that depend on them.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
Windmill Labs Windmill 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Windmill Labs Windmill是Windmill Labs组织的一款可构建内部工具与自动化工作流的软件平台。 Windmill Labs Windmill 1.783.0及之前版本存在授权问题漏洞，该漏洞源于update_resource_type端点缺少管理员权限检查，可能导致已认证的工作区成员覆盖任意资源类型schema，破坏资源类型定义，中断依赖它们的工作流。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Windmill Labs | Windmill | 0 ~ 1.783.0 | - |
|
II. Public POCs for CVE-2026-72541
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-72541
请登录查看更多情报信息。
Same Patch Batch · Windmill Labs · 2026-08-11 · 3 CVEs total
| CVE-2026-72539 | 6.5 MEDIUM | Windmill Labs Windmill - Information Disclosure |
| CVE-2026-72542 | 5.4 MEDIUM | Windmill Labs Windmill - Missing Authorization |
IV. Related Vulnerabilities
Same product: Windmill
-
CVE-2026-54136
Windmill: Resource-scoped API tokens can read script content -
CVE-2026-72542
Windmill Labs Windmill - Missing Authorization -
CVE-2026-72539
Windmill Labs Windmill - Information Disclosure -
CVE-2026-47107
Windmill < 1.703.2 Incorrect Default Permissions in nsjail C -
CVE-2026-33881
Windmill: Rogue Workspace Admins can inject code via unescap
Same weakness: CWE-306
-
CVE-2026-108473
Improper Authentication and Credential Exposure in Multiple -
CVE-2026-97793
Windows Setup and Deployment Elevation of Privilege Vulnerab -
CVE-2026-96858
Windows Security Account Manager Tampering Vulnerability -
CVE-2026-85884
Windows Health and Optimized Experiences Service Elevation o -
CVE-2026-83656
Windows Modern Device Management (MDM) Tampering Vulnerabili
V. Comments for CVE-2026-72541
No comments yet