medium6.5
CVE-2026-72541
A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema…
Impact
A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the update_resource_type endpoint. The endpoint omits the administrator permission check that the corresponding delete_resource_type endpoint enforces. An attacker with workspace member privileges can corrupt resource type definitions, breaking workflows that depend on them.
Affected products
| Product | Affected versions |
|---|---|
| Windmill Labs Windmill | through 1.783.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.