CVE-2026-72541

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-72541
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72541.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-72541
Published
2026-08-11T11:08:18Z
Modified
2026-09-05T11:45:33Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
Windmill Labs Windmill - Missing Authorization
Details

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the update_resource_type endpoint. The endpoint omits the administrator permission check that the corresponding delete_resource_type endpoint enforces. An attacker with workspace member privileges can corrupt resource type definitions, breaking workflows that depend on them.

Database specific 
{
    "cna_assigner": "TuranSec",
    "cwe_ids": [
        "CWE-306"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72541.json"
}
References

Affected packages

Git / github.com/windmill-labs/windmill

Affected ranges

Type
GIT
Repo
https://github.com/windmill-labs/windmill
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
099efa358aa615dcd1cbba45cfb7d7b4d9a411e0
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.783.0"
        },
        {
            "fixed": "1.783.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

1.*
1.422.3
1.462.2
1.462.3
1.462.4
1.463.4
1.463.5
Other
pr-assets
v1.*
v1.417.0
v1.417.1
v1.417.2
v1.417.3
v1.418.0
v1.419.0
v1.420.0
v1.420.1
v1.421.0
v1.421.1
v1.421.2
v1.422.0
v1.422.1
v1.423.0
v1.423.1
v1.423.2
v1.424.0
v1.425.0
v1.425.1
v1.426.0
v1.426.1
v1.427.0
v1.428.0
v1.428.1
v1.429.0
v1.430.0
v1.430.1
v1.430.2
v1.431.0
v1.431.1
v1.432.0
v1.433.0
v1.434.0
v1.434.1
v1.434.2
v1.435.0
v1.435.1
v1.435.2
v1.436.0
v1.437.0
v1.437.1
v1.438.0
v1.439.0
v1.440.0
v1.440.1
v1.440.2
v1.440.3
v1.441.0
v1.441.1
v1.441.2
v1.442.0
v1.443.0
v1.444.0
v1.445.0
v1.445.1
v1.446.0
v1.447.0
v1.447.1
v1.447.2
v1.447.3
v1.447.4
v1.447.5
v1.447.6
v1.448.0
v1.448.1
v1.449.0
v1.449.1
v1.449.2
v1.449.3
v1.450.0
v1.450.1
v1.451.0
v1.452.0
v1.452.1
v1.453.0
v1.453.1
v1.454.0
v1.454.1
v1.455.0
v1.455.1
v1.455.2
v1.456.0
v1.457.0
v1.457.1
v1.458.0
v1.458.1
v1.458.2
v1.458.3
v1.458.4
v1.459.0
v1.460.0
v1.460.1
v1.461.0
v1.461.1
v1.462.0
v1.462.1
v1.463.0
v1.463.1
v1.463.2
v1.463.3
v1.463.5
v1.463.6
v1.464.0
v1.465.0
v1.466.0
v1.466.1
v1.466.2
v1.466.3
v1.467.0
v1.467.1
v1.468.0
v1.469.0
v1.470.0
v1.470.1
v1.471.0
v1.471.1
v1.472.0
v1.472.1
v1.473.0
v1.473.1
v1.474.0
v1.475.0
v1.475.1
v1.476.0
v1.477.0
v1.477.1
v1.478.0
v1.478.1
v1.479.0
v1.479.1
v1.479.2
v1.479.3
v1.480.0
v1.480.1
v1.481.0
v1.482.0
v1.482.1
v1.483.0
v1.483.1
v1.483.2
v1.484.0
v1.485.0
v1.485.1
v1.485.2
v1.485.3
v1.486.0
v1.486.1
v1.487.0
v1.488.0
v1.489.0
v1.490.0
v1.491.0
v1.491.1
v1.491.2
v1.491.3
v1.491.4
v1.491.5
v1.492.0
v1.492.1
v1.493.0
v1.493.1
v1.493.2
v1.493.3
v1.493.4
v1.494.0
v1.495.0
v1.495.1
v1.496.0
v1.496.1
v1.496.2
v1.496.3
v1.497.0
v1.497.1
v1.497.2
v1.498.0
v1.499.0
v1.500.0
v1.500.1
v1.500.2
v1.500.3
v1.501.0
v1.501.1
v1.501.2
v1.501.3
v1.501.4
v1.502.0
v1.502.1
v1.502.2
v1.503.0
v1.503.1
v1.503.2
v1.503.3
v1.504.0
v1.505.0
v1.505.1
v1.505.2
v1.505.3
v1.505.4
v1.506.0
v1.507.0
v1.507.1
v1.507.2
v1.508.0
v1.509.0
v1.509.1
v1.509.2
v1.510.0
v1.510.1
v1.511.0
v1.512.0
v1.513.0
v1.513.1
v1.514.0
v1.514.1
v1.515.0
v1.515.1
v1.516.0
v1.517.0
v1.518.0
v1.518.1
v1.518.2
v1.519.0
v1.519.1
v1.519.2
v1.520.0
v1.520.1
v1.521.0
v1.522.0
v1.522.1
v1.523.0
v1.524.0
v1.525.0
v1.526.0
v1.526.1
v1.527.0
v1.527.1
v1.528.0
v1.529.0
v1.530.0
v1.531.0
v1.532.0
v1.533.0
v1.533.1
v1.534.0
v1.534.1
v1.535.0
v1.536.0
v1.537.0
v1.537.1
v1.538.0
v1.539.0
v1.539.1
v1.540.0
v1.540.1
v1.540.2
v1.541.0
v1.541.1
v1.542.0
v1.542.1
v1.542.2
v1.542.3
v1.542.4
v1.543.0
v1.544.0
v1.544.1
v1.544.2
v1.545.0
v1.546.0
v1.546.1
v1.547.0
v1.548.0
v1.548.1
v1.548.2
v1.548.3
v1.549.0
v1.549.1
v1.550.0
v1.551.0
v1.551.1
v1.551.2
v1.551.3
v1.551.4
v1.552.0
v1.552.1
v1.553.0
v1.554.0
v1.554.1
v1.555.0
v1.555.1
v1.555.2
v1.556.0
v1.556.1
v1.557.0
v1.558.0
v1.558.1
v1.559.0
v1.560.0
v1.561.0
v1.562.0
v1.563.0
v1.563.1
v1.563.2
v1.563.3
v1.563.4
v1.564.0
v1.565.0
v1.566.0
v1.566.1
v1.567.0
v1.567.1
v1.567.2
v1.567.3
v1.568.0
v1.569.0
v1.570.0
v1.571.0
v1.572.0
v1.572.1
v1.572.2
v1.573.0
v1.573.1
v1.573.2
v1.573.3
v1.573.4
v1.573.5
v1.574.0
v1.574.1
v1.574.2
v1.574.3
v1.575.0
v1.575.1
v1.575.2
v1.575.3
v1.575.4
v1.576.0
v1.576.1
v1.576.2
v1.576.3
v1.577.0
v1.578.0
v1.579.0
v1.579.1
v1.579.2
v1.580.0
v1.581.0
v1.581.1
v1.582.0
v1.582.1
v1.582.2
v1.583.0
v1.583.1
v1.583.2
v1.583.3
v1.584.0
v1.585.0
v1.585.1
v1.586.0
v1.587.0
v1.587.1
v1.588.0
v1.589.0
v1.589.1
v1.589.2
v1.589.3
v1.590.0
v1.591.0
v1.591.1
v1.591.2
v1.591.3
v1.591.4
v1.592.0
v1.592.1
v1.593.0
v1.593.1
v1.594.0
v1.595.0
v1.596.0
v1.597.0
v1.597.1
v1.598.0
v1.599.0
v1.599.1
v1.599.2
v1.599.3
v1.600.0
v1.600.1
v1.601.0
v1.601.1
v1.602.0
v1.603.0
v1.603.1
v1.603.2
v1.603.3
v1.603.4
v1.604.0
v1.605.0
v1.606.0
v1.606.1
v1.607.0
v1.607.1
v1.608.0
v1.609.0
v1.610.0
v1.610.1
v1.611.0
v1.612.0
v1.612.1
v1.612.2
v1.613.0
v1.613.1
v1.613.2
v1.613.3
v1.613.4
v1.614.0
v1.615.0
v1.615.1
v1.615.2
v1.615.3
v1.616.0
v1.617.0
v1.617.1
v1.617.2
v1.617.3
v1.618.0
v1.618.1
v1.618.2
v1.619.0
v1.620.0
v1.620.1
v1.621.0
v1.621.1
v1.621.2
v1.622.0
v1.623.0
v1.623.1
v1.624.0
v1.625.0
v1.626.0
v1.627.0
v1.628.0
v1.628.1
v1.628.2
v1.628.3
v1.629.0
v1.629.1
v1.630.0
v1.630.1
v1.630.2
v1.631.0
v1.631.1
v1.631.2
v1.632.0
v1.633.0
v1.633.1
v1.634.0
v1.634.1
v1.634.2
v1.634.3
v1.634.4
v1.634.5
v1.634.6
v1.635.0
v1.635.1
v1.636.0
v1.637.0
v1.638.0
v1.638.1
v1.638.2
v1.638.3
v1.638.4
v1.639.0
v1.640.0
v1.641.0
v1.642.0
v1.643.0
v1.644.0
v1.645.0
v1.646.0
v1.647.0
v1.647.1
v1.647.2
v1.648.0
v1.649.0
v1.650.0
v1.651.0
v1.651.1
v1.652.0
v1.653.0
v1.654.0
v1.655.0
v1.656.0
v1.657.0
v1.657.1
v1.657.2
v1.658.0
v1.659.0
v1.659.1
v1.660.0
v1.660.1
v1.661.0
v1.662.0
v1.663.0
v1.664.0
v1.665.0
v1.666.0
v1.667.0
v1.668.0
v1.668.1
v1.668.2
v1.668.3
v1.668.4
v1.668.5
v1.669.0
v1.669.1
v1.670.0
v1.671.0
v1.672.0
v1.673.0
v1.674.0
v1.674.1
v1.674.2
v1.675.0
v1.675.1
v1.676.0
v1.677.0
v1.678.0
v1.679.0
v1.680.0
v1.681.0
v1.682.0
v1.683.0
v1.683.1
v1.683.2
v1.684.0
v1.684.1
v1.685.0
v1.686.0
v1.687.0
v1.688.0
v1.689.0
v1.690.0
v1.691.0
v1.691.1
v1.692.0
v1.693.0
v1.693.1
v1.693.2
v1.693.3
v1.693.4
v1.694.0
v1.695.0
v1.696.0
v1.696.1
v1.696.2
v1.697.0
v1.698.0
v1.699.0
v1.700.0
v1.700.1
v1.700.2
v1.701.0
v1.702.0
v1.702.1
v1.703.0
v1.703.1
v1.703.2
v1.703.3
v1.704.0
v1.704.1
v1.705.0
v1.706.0
v1.706.1
v1.707.0
v1.708.0
v1.709.0
v1.710.0
v1.710.1
v1.711.0
v1.712.0
v1.713.0
v1.713.1
v1.714.0
v1.714.1
v1.715.0
v1.716.0
v1.717.0
v1.717.1
v1.718.0
v1.719.0
v1.720.0
v1.721.0
v1.722.0
v1.723.0
v1.724.0
v1.725.0
v1.725.1
v1.726.0
v1.726.1
v1.727.0
v1.728.0
v1.728.1
v1.729.0
v1.730.0
v1.731.0
v1.732.0
v1.733.0
v1.733.1
v1.734.0
v1.735.0
v1.736.0
v1.737.0
v1.738.0
v1.739.0
v1.740.0
v1.741.0
v1.742.0
v1.743.0
v1.744.0
v1.745.0
v1.746.0
v1.747.0
v1.748.0
v1.749.0
v1.750.0
v1.751.0
v1.752.0
v1.753.0
v1.754.0
v1.755.0
v1.756.0
v1.756.1
v1.757.0
v1.758.0
v1.759.0
v1.760.0
v1.760.1
v1.761.0
v1.762.0
v1.762.1
v1.762.2
v1.763.0
v1.764.0
v1.765.0
v1.766.0
v1.766.1
v1.766.2
v1.767.0
v1.768.0
v1.769.0
v1.770.0
v1.771.0
v1.771.1
v1.772.0
v1.773.0
v1.774.0
v1.775.0
v1.775.1
v1.775.2
v1.776.0
v1.777.0
v1.777.1
v1.778.0
v1.779.0
v1.780.0
v1.781.0
v1.781.1
v1.781.2
v1.781.3
v1.782.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72541.json"