CVE Watch11 ago 2026

CVE-2026-72542

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write job progress and rea

CVSS

5.4

Medio

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 11 ago 2026 · Última mod.: 11 ago 2026 · CWE-306

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write job progress and read job metrics for any job in the workspace regardless of ownership. The job_metrics handlers accept no authorization extractor, bypassing workspace-level access controls. An operator can monitor sensitive job execution data and inject misleading progress for jobs they do not own.

Referencias oficiales

github.comhttps://github.com/windmill-labs/windmill

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-649218.8 ALT

—

———Missing authentication for critical function in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.6h CVE-2026-627777.8 ALT

—

———Missing authentication for critical function in Windows License Manager allows an authorized attacker to elevate privileges locally.6h CVE-2026-613677.8 ALT

—

———Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.6h CVE-2026-613657.8 ALT

—

———Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.6h CVE-2026-613647.8 ALT

—

———Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.6h CVE-2026-613567.8 ALT

—

———Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.6h