CVE WatchAug 11, 2026

CVE-2026-72541

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any r

CVSS

6.5

Medium

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Aug 11, 2026 · Last modified: Aug 11, 2026 · CWE-306

EPSS · 30d

Not enough EPSS history yet.

Technical description

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the update_resource_type endpoint. The endpoint omits the administrator permission check that the corresponding delete_resource_type endpoint enforces. An attacker with workspace member privileges can corrupt resource type definitions, breaking workflows that depend on them.

Official references

github.comhttps://github.com/windmill-labs/windmill

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-649218.8 HIG

—

———Missing authentication for critical function in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.5h CVE-2026-627777.8 HIG

—

———Missing authentication for critical function in Windows License Manager allows an authorized attacker to elevate privileges locally.5h CVE-2026-613677.8 HIG

—

———Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.5h CVE-2026-613657.8 HIG

—

———Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.5h CVE-2026-613647.8 HIG

—

———Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.5h CVE-2026-613567.8 HIG

—

———Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.5h