CVE-2026-72541 Windmill Labs Windmill - Missing Authorization

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the updateresourcetype endpoint. The endpoint omits the administrator permission check that the corresponding deleteresourcetype...

CVE-2026-72541 Windmill Labs Windmill - Missing Authorization

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the updateresourcetype endpoint. The endpoint omits the administrator permission check that the corresponding deleteresourcetype...

CVE-2026-72541

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the updateresourcetype endpoint. The endpoint omits the administrator permission check that the corresponding deleteresourcetype...

EUVD-2026-56011

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the updateresourcetype endpoint. The endpoint omits the administrator permission check that the corresponding deleteresourcetype...

CVE-2026-72541 Windmill Labs Windmill - Missing Authorization

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the updateresourcetype endpoint. The endpoint omits the administrator permission check that the corresponding deleteresourcetype...

CVE-2026-72539 Windmill Labs Windmill - Information Disclosure

An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that contain plaintext resource credentials. Drafts with a null owner email bypass ACL enforcement and are returned to any workspace...

CVE-2026-72539

An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that contain plaintext resource credentials. Drafts with a null owner email bypass ACL enforcement and are returned to any workspace...

EUVD-2026-56009

An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that contain plaintext resource credentials. Drafts with a null owner email bypass ACL enforcement and are returned to any workspace...

CVE-2026-72539 Windmill Labs Windmill - Information Disclosure

An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that contain plaintext resource credentials. Drafts with a null owner email bypass ACL enforcement and are returned to any workspace...

CVE-2026-72539

Summary : CVE-2026-72539 affects Windmill Labs Windmill up to version 1.783.0, causing information disclosure. Affected component : drafts data store accessed via the Windmill drafts endpoint. Root cause : legacy ownerless drafts with null owner emails bypass ACL enforcement, allowing any authent...

CVE-2026-72539 Windmill Labs Windmill - Information Disclosure

An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that contain plaintext resource credentials. Drafts with a null owner email bypass ACL enforcement and are returned to any workspace...

CVE-2026-72542: Missing Authentication for Critical Function

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write job progress and read job metrics for any job in the workspace regardless of ownership. The jobmetrics handlers accept no authorization extractor, bypassing workspace-level acce...

CVE-2026-72541: Missing Authentication for Critical Function

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the updateresourcetype endpoint. The endpoint omits the administrator permission check that the corresponding deleteresourcetype...

PT-2026-70117

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write job progress and read job metrics for any job in the workspace regardless of ownership. The job metrics handlers accept no authorization extractor, bypassing workspace-level...

PT-2026-70116

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the update resource type endpoint. The endpoint omits the administrator permission check that the corresponding delete resource type...

PT-2026-70114

An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that contain plaintext resource credentials. Drafts with a null owner email bypass ACL enforcement and are returned to any workspace...

CVE-2026-72539: Exposure of Sensitive Information to an Unauthorized Actor

An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that contain plaintext resource credentials. Drafts with a null owner email bypass ACL enforcement and are returned to any workspace...

Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication

A high-severity security flaw impacting open-source developer platform Windmill has come under active exploitation in the wild, per VulnCheck. The vulnerability in question is CVE-2026-29059 CVSS score: 7.5, a case of unauthenticated path traversal impacting Windmill's "getlogfile" endpoint...

VulnCheck KEV: CVE-2026-29059

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to version 1.603.3, an unauthenticated path traversal vulnerability exists in Windmill's getlogfile endpoint "/api/w/workspace/jobsu/getlogfile/filename". The filename parameter is...

Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search

Summary A resource-scoped API token can read script contents outside its allowed path scope via GET /api/w/workspace/scripts/listsearch. This appears to be a remaining variant of the scoped-token authorization class previously addressed for other endpoints. The route-level scope middleware...