CVE-2026-72541 Overview
CVE-2026-72541 is a missing authorization vulnerability affecting Windmill Labs Windmill through version 1.783.0. The flaw resides in the update_resource_type endpoint, which fails to enforce the administrator permission check applied by the corresponding delete_resource_type endpoint. Any authenticated workspace member can overwrite arbitrary resource type schemas, corrupting definitions that workflows depend on. The weakness is tracked as [CWE-306] Missing Authentication for a Critical Function and carries an integrity-focused impact with no confidentiality or availability effect on the underlying host.
Critical Impact
Authenticated workspace members can overwrite any resource type schema, breaking downstream workflows that rely on those definitions.
Affected Products
- Windmill Labs Windmill through 1.783.0
- Self-hosted Windmill deployments exposing multi-user workspaces
- Windmill Cloud tenants running affected releases
Discovery Timeline
- 2026-08-11 - CVE-2026-72541 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-72541
Vulnerability Analysis
Windmill is a developer platform for building internal tools and workflows using scripts, flows, and typed resources. Resource types define the schema of reusable resources referenced across workflows. Administrative operations on those types are expected to be restricted to workspace administrators.
The delete_resource_type endpoint correctly enforces an administrator permission check before mutating a resource type. The update_resource_type endpoint omits this check. As a result, any authenticated principal with workspace member privileges can submit an update request and replace the schema of any resource type in the workspace.
The consequence is integrity loss across dependent workflows. Scripts and flows that reference a corrupted resource type will fail validation, deserialize incorrect fields, or execute with attacker-controlled schema constraints.
Root Cause
The root cause is inconsistent authorization enforcement between paired endpoints. The update_resource_type handler lacks the administrator role check present in delete_resource_type, leaving the mutation path open to lower-privileged workspace members [CWE-306].
Attack Vector
Exploitation requires network access to the Windmill API and valid workspace member credentials. No user interaction is required. An attacker who obtains any workspace-scoped session, API token, or member account can call the update_resource_type endpoint and overwrite target schemas. Refer to the Windmill GitHub repository for endpoint definitions and the corrective changes.
Detection Methods for CVE-2026-72541
Indicators of Compromise
- Unexpected PUT or POST requests to the update_resource_type endpoint originating from non-administrator workspace members.
- Resource type schemas modified outside of scheduled change windows or by accounts without prior administrative activity.
- Workflow execution failures citing schema validation errors on resources that previously ran successfully.
Detection Strategies
- Correlate Windmill audit logs with workspace role assignments to flag schema mutations performed by non-admin members.
- Baseline the set of principals that legitimately modify resource types and alert on deviations.
- Compare current resource type schemas against version-controlled definitions to identify unauthorized drift.
Monitoring Recommendations
- Forward Windmill application and API access logs to a centralized analytics platform for query and retention.
- Alert on any HTTP call to update_resource_type where the caller lacks the workspace administrator role.
- Monitor workflow failure rates for spikes that coincide with resource type modifications.
How to Mitigate CVE-2026-72541
Immediate Actions Required
- Upgrade Windmill to a fixed release published after 1.783.0 once available from Windmill Labs.
- Audit workspace member rosters and revoke access for accounts that do not require workspace-level privileges.
- Export and back up current resource type schemas so integrity baselines exist for comparison and recovery.
Patch Information
Windmill Labs maintains the project on GitHub. Track the Windmill repository for release notes and commits that add the administrator permission check to the update_resource_type endpoint. Apply the fixed version to all self-hosted deployments and confirm Windmill Cloud tenants are running a patched build.
Workarounds
- Restrict workspace membership to trusted operators until the patched release is deployed.
- Place the Windmill API behind a reverse proxy that blocks update_resource_type calls from non-administrator identities.
- Rotate API tokens issued to workspace members to reduce the window of exposure for compromised credentials.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
