CVE-2026-72541 in Windmill
Summary
by MITRE • 08/11/2026
A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the update_resource_type endpoint. The endpoint omits the administrator permission check that the corresponding delete_resource_type endpoint enforces. An attacker with workspace member privileges can corrupt resource type definitions, breaking workflows that depend on them.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability represents a critical authorization flaw in Windmill Labs Windmill platform version 1.783.0 and earlier, where the update_resource_type endpoint lacks proper administrative permission verification that exists in the delete_resource_type counterpart. The missing authorization check creates a privilege escalation vector that allows any authenticated workspace member to manipulate resource type schemas, fundamentally undermining the platform's access control mechanisms. This issue manifests as a direct violation of the principle of least privilege and demonstrates poor defensive programming practices in the application's security architecture.
The technical implementation flaw stems from inconsistent permission enforcement across related endpoints within the Windmill platform's administrative interface. While the delete_resource_type endpoint properly validates administrator credentials before executing schema deletion operations, the update_resource_type endpoint fails to perform equivalent authorization checks. This inconsistency creates a dangerous gap where authenticated users can modify critical system components without proper administrative clearance, potentially leading to data corruption and service disruption. The vulnerability aligns with CWE-284 (Improper Access Control) and represents an authorization bypass that could be classified under ATT&CK technique T1078.004 (Valid Accounts: Cloud Accounts) when exploited by attackers who have gained initial access to workspace memberships.
The operational impact of this vulnerability extends beyond simple data modification, as corrupted resource type definitions can cause cascading failures throughout dependent workflows and automated processes. When an attacker overwrites resource type schemas, they can introduce malformed configurations that break existing integrations, disrupt automated task execution, or create inconsistencies in data processing pipelines. This creates a significant risk for organizations relying on Windmill for workflow automation, as the compromise of resource type definitions can lead to service degradation, data loss, or complete workflow failures. The vulnerability affects all authenticated workspace members regardless of their specific role assignments, making it particularly dangerous in environments where multiple users have access to the platform.
Organizations should immediately implement compensating controls such as monitoring for unauthorized resource type modifications and restricting network access to the affected endpoints through firewall rules or API gateways. The most effective mitigation involves patching the platform to ensure consistent authorization checks across all administrative endpoints, specifically implementing mandatory administrator permission verification for both update_resource_type and delete_resource_type operations. Security teams should also conduct comprehensive audits of other similar endpoints to identify potential authorization gaps in the system's access control implementation. Additionally, organizations should consider implementing automated workflow validation mechanisms that can detect schema inconsistencies and alert administrators to unauthorized modifications, as outlined in security best practices from NIST SP 800-53 and ISO/IEC 27001 frameworks.