Authorization Bypass in Windmill Allows Unauthorized Modifications

CVE-2026-22683

What is CVE-2026-22683?

A critical authorization bypass vulnerability exists in Windmill, versions 1.56.0 through 1.614.0, allowing users with the Operator role to perform actions that should be restricted, such as entity creation and modification via the backend API. Although Operators are intended to lack permission for such actions, the API fails to enforce these controls on workspace endpoints. This oversight can lead to privilege escalation, enabling Operators to create and modify scripts, flows, and apps, as well as potentially execute scripts through the jobs API, which poses a serious risk of remote code execution. This flaw has been present since the introduction of the Operator role.

References