MEDIUM 6.5 NVD

CVE-2026-72541

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the update_resource_type endpoint. The endpoint omits the administrator permission check that the corresponding delete_resource_type endpoint enforces. An attacker with workspace member privileges can corrupt resource type definitions, breaking workflows that depend on them.

References

https://github.com/windmill-labs/windmill

Published: 2026-08-11 · Source: NVD · Feed updated: 2026-08-11

This medium severity vulnerability with a CVSS score of 6.5 was published on 2026-08-11 via NVD.

vulnfeed aggregates 9850 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.