Medium
Windmill Labs Windmill - Missing Authorization
Type: advisorySources: OSV
A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the update_resource_type endpoint. The endpoint omits the administrator permission check that the corresponding delete_resource_type endpoint enforces. An attacker with workspace member privileges can corrupt resource type definitions, breaking workflows that depend on them.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-72541
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 03:00 UTC · Revision 1
Source evidence
Windmill Labs Windmill - Missing Authorization
core-osv · Original sourcePublished 11 Aug 2026, 11:08 UTC
A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the update_resource_type endpoint. The endpoint omits the administrator permission check that the corresponding delete_resource_type endpoint enforces. An attacker with workspace member privileges can corrupt resource type definitions, breaking workflows that depend on them.
osv:CVE-2026-72541
Complete source record
{
"id": "e0395381cf1d318d3063c620a2524c52fac1cc0dc63b2ddaf48a3977ed7c71eb",
"url": "https://osv.dev/vulnerability/CVE-2026-72541",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Windmill Labs Windmill - Missing Authorization",
"summary": "A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the update_resource_type endpoint. The endpoint omits the administrator permission check that the corresponding delete_resource_type endpoint enforces. An attacker with workspace member privileges can corrupt resource type definitions, breaking workflows that depend on them.",
"evidence": "osv:CVE-2026-72541",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-72541",
"aliases": [
"CVE-2026-72541"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/windmill-labs/windmill",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "099efa358aa615dcd1cbba45cfb7d7b4d9a411e0"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "1.783.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "1.783.0"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"v1.783.0",
"v1.782.0",
"v1.781.1",
"v1.781.3",
"v1.781.2",
"v1.781.0",
"v1.780.0",
"v1.779.0",
"v1.778.0",
"v1.777.1",
"v1.777.0",
"v1.776.0",
"v1.775.2",
"v1.775.1",
"v1.775.0",
"v1.774.0",
"v1.773.0",
"v1.772.0",
"v1.771.1",
"v1.771.0",
"v1.770.0",
"v1.769.0",
"v1.768.0",
"v1.767.0",
"v1.766.2",
"v1.766.1",
"v1.766.0",
"v1.765.0",
"v1.764.0",
"v1.763.0",
"v1.762.2",
"v1.761.0",
"v1.762.0",
"v1.762.1",
"v1.757.0",
"v1.760.1",
"v1.760.0",
"v1.756.0",
"v1.759.0",
"v1.758.0",
"v1.756.1",
"v1.755.0",
"v1.754.0",
"v1.751.0",
"v1.753.0",
"v1.752.0",
"v1.750.0",
"v1.749.0",
"v1.748.0",
"v1.747.0",
"v1.746.0",
"v1.742.0",
"v1.745.0",
"v1.744.0",
"v1.743.0",
"v1.741.0",
"v1.740.0",
"v1.733.1",
"v1.739.0",
"v1.735.0",
"v1.738.0",
"v1.737.0",
"v1.734.0",
"v1.736.0",
"v1.733.0",
"v1.732.0",
"v1.730.0",
"v1.731.0",
"v1.729.0",
"v1.728.1",
"v1.728.0",
"v1.727.0",
"v1.726.1",
"v1.726.0",
"v1.725.1",
"v1.725.0",
"v1.724.0",
"v1.723.0",
"v1.721.0",
"v1.722.0",
"v1.719.0",
"v1.720.0",
"v1.718.0",
"v1.708.0",
"v1.717.1",
"v1.717.0",
"v1.716.0",
"v1.715.0",
"v1.714.1",
"v1.714.0",
"v1.713.1",
"v1.713.0",
"v1.710.0",
"v1.712.0",
"v1.711.0",
"v1.710.1",
"v1.709.0",
"v1.707.0",
"v1.706.1",
"v1.706.0",
"v1.705.0",
"v1.704.1",
"v1.704.0",
"v1.703.1",
"v1.703.3",
"v1.703.2",
"v1.703.0",
"v1.702.1",
"v1.702.0",
"v1.701.0",
"v1.696.1",
"v1.700.2",
"v1.700.1",
"v1.700.0",
"v1.697.0",
"v1.699.0",
"v1.698.0",
"v1.696.2",
"v1.696.0",
"v1.695.0",
"v1.694.0",
"v1.693.4",
"v1.693.3",
"v1.693.2",
"v1.693.1",
"v1.693.0",
"v1.692.0",
"v1.691.1",
"v1.691.0",
"v1.690.0",
"v1.689.0",
"v1.688.0",
"v1.687.0",
"v1.686.0",
"v1.685.0",
"v1.684.1",
"v1.684.0",
"v1.683.2",
"v1.683.1",
"v1.683.0",
"v1.682.0",
"v1.681.0",
"v1.680.0",
"v1.677.0",
"v1.679.0",
"v1.678.0",
"v1.675.0",
"v1.676.0",
"v1.675.1",
"v1.674.2",
"v1.674.1",
"v1.674.0",
"v1.673.0",
"v1.670.0",
"v1.672.0",
"v1.671.0",
"v1.669.1",
"v1.669.0",
"v1.668.5",
"v1.668.4",
"v1.668.3",
"v1.668.2",
"v1.668.1",
"v1.668.0",
"v1.667.0",
"v1.666.0",
"v1.665.0",
"v1.664.0",
"v1.663.0",
"v1.662.0",
"v1.661.0",
"v1.660.1",
"v1.660.0",
"v1.659.1",
"v1.659.0",
"v1.658.0",
"v1.657.2",
"v1.657.1",
"v1.657.0",
"v1.656.0",
"v1.655.0",
"v1.653.0",
"v1.654.0",
"v1.652.0",
"v1.651.1",
"v1.651.0",
"v1.650.0",
"v1.649.0",
"v1.648.0",
"v1.647.1",
"v1.647.2",
"v1.647.0",
"v1.646.0",
"v1.645.0",
"v1.644.0",
"v1.643.0",
"v1.642.0",
"v1.641.0",
"v1.640.0",
"v1.638.3",
"v1.639.0",
"v1.638.4",
"v1.638.2",
"v1.638.1",
"v1.638.0",
"v1.637.0",
"v1.636.0",
"pr-assets",
"v1.635.1",
"v1.635.0",
"v1.634.6",
"v1.634.5",
"v1.634.4",
"v1.634.3",
"v1.634.2",
"v1.634.1",
"v1.634.0",
"v1.633.1",
"v1.633.0",
"v1.632.0",
"v1.631.2",
"v1.631.1",
"v1.631.0",
"v1.630.2",
"v1.630.1",
"v1.630.0",
"v1.629.1",
"v1.629.0",
"v1.628.3",
"v1.628.2",
"v1.628.1",
"v1.628.0",
"v1.627.0",
"v1.626.0",
"v1.625.0",
"v1.624.0",
"v1.623.1",
"v1.623.0",
"v1.622.0",
"v1.621.2",
"v1.621.1",
"v1.621.0",
"v1.620.1",
"v1.620.0",
"v1.619.0",
"v1.618.2",
"v1.618.1",
"v1.618.0",
"v1.617.3",
"v1.617.2",
"v1.617.1",
"v1.617.0",
"v1.616.0",
"v1.615.3",
"v1.615.2",
"v1.615.1",
"v1.615.0",
"v1.614.0",
"v1.613.4",
"v1.613.3",
"v1.613.2",
"v1.613.1",
"v1.613.0",
"v1.612.2",
"v1.612.1",
"v1.612.0",
"v1.611.0",
"v1.610.1",
"v1.610.0",
"v1.609.0",
"v1.608.0",
"v1.607.1",
"v1.607.0",
"v1.606.1",
"v1.606.0",
"v1.605.0",
"v1.604.0",
"v1.603.4",
"v1.603.3",
"v1.603.2",
"v1.603.1",
"v1.603.0",
"v1.602.0",
"v1.601.1",
"v1.601.0",
"v1.600.1",
"v1.600.0",
"v1.599.3",
"v1.599.2",
"v1.599.1",
"v1.599.0",
"v1.598.0",
"v1.597.1",
"v1.597.0",
"v1.596.0",
"v1.595.0",
"v1.594.0",
"v1.593.1",
"v1.593.0",
"v1.592.1",
"v1.592.0",
"v1.591.4",
"v1.591.3",
"v1.591.2",
"v1.591.1",
"v1.591.0",
"v1.590.0",
"v1.589.3",
"v1.589.2",
"v1.589.1",
"v1.589.0",
"v1.588.0",
"v1.587.1",
"v1.587.0",
"v1.586.0",
"v1.585.1",
"v1.585.0",
"v1.584.0",
"v1.583.3",
"v1.583.2",
"v1.583.0",
"v1.583.1",
"v1.582.2",
"v1.582.1",
"v1.582.0",
"v1.581.1",
"v1.581.0",
"v1.580.0",
"v1.579.2",
"v1.579.1",
"v1.579.0",
"v1.578.0",
"v1.577.0",
"v1.576.3",
"v1.576.2",
"v1.576.1",
"v1.576.0",
"v1.575.4",
"v1.575.3",
"v1.575.2",
"v1.575.1",
"v1.575.0",
"v1.574.3",
"v1.574.2",
"v1.574.1",
"v1.574.0",
"v1.573.5",
"v1.573.4",
"v1.573.3",
"v1.573.2",
"v1.573.1",
"v1.573.0",
"v1.572.2",
"v1.572.1",
"v1.572.0",
"v1.571.0",
"v1.570.0",
"v1.569.0",
"v1.568.0",
"v1.567.3",
"v1.566.1",
"v1.567.2",
"v1.567.1",
"v1.567.0",
"v1.566.0",
"v1.565.0",
"v1.564.0",
"v1.563.4",
"v1.563.3",
"v1.563.2",
"v1.563.1",
"v1.563.0",
"v1.562.0",
"v1.561.0",
"v1.560.0",
"v1.559.0",
"v1.558.1",
"v1.558.0",
"v1.557.0",
"v1.556.1",
"v1.556.0",
"v1.555.2",
"v1.555.1",
"v1.555.0",
"v1.554.1",
"v1.554.0",
"v1.553.0",
"v1.552.1",
"v1.552.0",
"v1.551.4",
"v1.551.3",
"v1.551.2",
"v1.551.1",
"v1.551.0",
"v1.550.0",
"v1.549.1",
"v1.549.0",
"v1.548.3",
"v1.548.2",
"v1.548.1",
"v1.548.0",
"v1.547.0",
"v1.546.1",
"v1.546.0",
"v1.545.0",
"v1.544.2",
"v1.544.1",
"v1.544.0",
"v1.543.0",
"v1.542.4",
"v1.542.3",
"v1.542.2",
"v1.542.1",
"v1.542.0",
"v1.541.1",
"v1.541.0",
"v1.540.2",
"v1.540.1",
"v1.540.0",
"v1.539.1",
"v1.539.0",
"v1.538.0",
"v1.537.1",
"v1.537.0",
"v1.536.0",
"v1.535.0",
"v1.534.1",
"v1.534.0",
"v1.533.1",
"v1.533.0",
"v1.532.0",
"v1.531.0",
"v1.530.0",
"v1.529.0",
"v1.528.0",
"v1.527.1",
"v1.527.0",
"v1.526.1",
"v1.526.0",
"v1.525.0",
"v1.524.0",
"v1.523.0",
"v1.522.1",
"v1.522.0",
"v1.521.0",
"v1.520.1",
"v1.520.0",
"v1.519.2",
"v1.519.1",
"v1.519.0",
"v1.518.2",
"v1.518.1",
"v1.518.0",
"v1.517.0",
"v1.516.0",
"v1.515.1",
"v1.515.0",
"v1.514.1",
"v1.514.0",
"v1.513.1",
"v1.513.0",
"v1.512.0",
"v1.511.0",
"v1.510.1",
"v1.510.0",
"v1.509.2",
"v1.509.1",
"v1.509.0",
"v1.508.0",
"v1.507.2",
"v1.507.1",
"v1.507.0",
"v1.506.0",
"v1.505.4",
"v1.505.3",
"v1.505.2",
"v1.505.1",
"v1.505.0",
"v1.504.0",
"v1.503.3",
"v1.503.2",
"v1.503.1",
"v1.503.0",
"v1.502.2",
"v1.502.1",
"v1.502.0",
"v1.501.4",
"v1.501.3",
"v1.501.2",
"v1.501.1",
"v1.501.0",
"v1.500.3",
"v1.500.2",
"v1.500.1",
"v1.500.0",
"v1.499.0",
"v1.498.0",
"v1.497.2",
"v1.497.1",
"v1.497.0",
"v1.496.3",
"v1.496.2",
"v1.496.1",
"v1.496.0",
"v1.495.1",
"v1.495.0",
"v1.494.0",
"v1.493.4",
"v1.493.3",
"v1.493.2",
"v1.493.1",
"v1.493.0",
"v1.492.1",
"v1.492.0",
"v1.491.5",
"v1.491.4",
"v1.491.3",
"v1.491.2",
"v1.491.1",
"v1.491.0",
"v1.490.0",
"v1.489.0",
"v1.488.0",
"v1.487.0",
"v1.486.1",
"v1.486.0",
"v1.485.3",
"v1.485.2",
"v1.485.1",
"v1.485.0",
"v1.484.0",
"v1.483.2",
"v1.483.1",
"v1.483.0",
"v1.482.1",
"v1.482.0",
"v1.481.0",
"v1.480.1",
"v1.480.0",
"v1.479.3",
"v1.479.2",
"v1.479.1",
"v1.479.0",
"v1.478.1",
"v1.478.0",
"v1.477.1",
"v1.477.0",
"v1.476.0",
"v1.475.1",
"v1.475.0",
"v1.474.0",
"v1.473.1",
"v1.473.0",
"v1.472.1",
"v1.472.0",
"v1.471.1",
"v1.471.0",
"v1.470.1",
"v1.470.0",
"v1.469.0",
"v1.467.1",
"v1.468.0",
"v1.467.0",
"v1.466.3",
"v1.466.2",
"v1.466.1",
"v1.466.0",
"v1.465.0",
"v1.464.0",
"v1.463.6",
"v1.463.5",
"1.463.5",
"1.463.4",
"v1.463.0",
"v1.463.3",
"v1.463.2",
"v1.463.1",
"1.462.4",
"1.462.3",
"1.462.2",
"1.422.3",
"v1.462.1",
"v1.462.0",
"v1.461.1",
"v1.461.0",
"v1.460.1",
"v1.460.0",
"v1.459.0",
"v1.458.4",
"v1.458.3",
"v1.458.2",
"v1.458.1",
"v1.458.0",
"v1.457.1",
"v1.457.0",
"v1.456.0",
"v1.455.2",
"v1.455.1",
"v1.455.0",
"v1.454.1",
"v1.454.0",
"v1.453.1",
"v1.453.0",
"v1.452.1",
"v1.452.0",
"v1.451.0",
"v1.450.1",
"v1.450.0",
"v1.449.3",
"v1.449.2",
"v1.449.1",
"v1.449.0",
"v1.448.1",
"v1.448.0",
"v1.447.6",
"v1.447.5",
"v1.447.4",
"v1.447.3",
"v1.447.2",
"v1.447.1",
"v1.447.0",
"v1.446.0",
"v1.445.1",
"v1.445.0",
"v1.444.0",
"v1.443.0",
"v1.442.0",
"v1.441.2",
"v1.441.1",
"v1.441.0",
"v1.440.3",
"v1.440.2",
"v1.440.1",
"v1.440.0",
"v1.439.0",
"v1.438.0",
"v1.437.1",
"v1.437.0",
"v1.436.0",
"v1.435.2",
"v1.435.1",
"v1.435.0",
"v1.434.2",
"v1.434.1",
"v1.434.0",
"v1.433.0",
"v1.432.0",
"v1.431.1",
"v1.431.0",
"v1.430.2",
"v1.430.1",
"v1.430.0",
"v1.429.0",
"v1.428.1",
"v1.428.0",
"v1.427.0",
"v1.426.1",
"v1.426.0",
"v1.425.1",
"v1.425.0",
"v1.424.0",
"v1.423.2",
"v1.423.1",
"v1.423.0",
"v1.422.1",
"v1.422.0",
"v1.421.2",
"v1.421.1",
"v1.421.0",
"v1.420.1",
"v1.420.0",
"v1.419.0",
"v1.418.0",
"v1.417.3",
"v1.417.2",
"v1.417.1",
"v1.417.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72541.json"
}
}
],
"modified": "2026-10-28T02:30:49.066391515Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72541.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-72541",
"https://github.com/windmill-labs/windmill"
],
"provider_metadata": {
"cwe_ids": [
"CWE-306"
],
"cna_assigner": "TuranSec",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72541.json"
}
},
"related_cves": [
{
"value": "CVE-2026-72541",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 517579,
"published_at": "2026-08-11T11:08:18.654+00:00"
}