Information Disclosure Vulnerability in Windmill Labs Product
CVE-2026-72539

6.5MEDIUM

Key Information:

Vendor

Windmill Labs

Status
Windmill
Vendor
CVE Published:
11 August 2026

What is CVE-2026-72539?

An information disclosure vulnerability in Windmill Labs' Windmill allows authenticated workspace members to access legacy ownerless draft scripts containing plaintext resource credentials. When drafts have a null owner email, they bypass access control list (ACL) enforcement, enabling any workspace member to query the drafts endpoint and access sensitive stored credentials. This poses a significant risk as it facilitates unauthorized access to sensitive information.

Affected Version(s)

Windmill 0 <= 1.783.0

References

https://github.com/windmill-labs/windmill

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bobur Abdugafforov (Mahadsec)
.