CVE-2026-72541 — Windmill Labs Windmill - Missing Authorization

CVE-2026-72541

Windmill Labs Windmill - Missing Authorization PUBLISHED

Description (CNA)

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the update_resource_type endpoint. The endpoint omits the administrator permission check that the corresponding delete_resource_type endpoint enforces. An attacker with workspace member privileges can corrupt resource type definitions, breaking workflows that depend on them.

Affected (CNA)

Vendor / product	Versions
Windmill Labs / Windmill	affected 0 through 1.783.0

CWE

CWE-306

References

https://github.com/windmill-labs/windmill

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.