PT-2026-30913 · Windmill · Windmill

Valentin Lobstein · CVE-2026-22683 · Published 2026-04-07 · Updated 2026-04-08

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windmill versions 1.56.0 through 1.614.0

Description Windmill versions 1.56.0 through 1.614.0 have a missing authorization vulnerability. Users with the Operator role can perform prohibited entity creation and modification actions via the backend API. The API does not enforce the Operator restriction on workspace endpoints, allowing Operators to create and update scripts, flows, apps, and raw apps. Operators can also execute scripts via the jobs API, potentially leading to remote code execution within the Windmill deployment.

Recommendations Update Windmill to a version later than 1.614.0.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-22683

Affected Products

Windmill

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22683.json · Exploit
• 🔥 https://github.com/Chocapikk/Windfall · Exploit
• 🔥 https://chocapikk.com/posts/2026/windfall-nextcloud-flow-windmill-rce · Exploit
• https://github.com/windmill-labs/windmill/commit/c621a74804f4f6e8318819c01e3a23a17698588b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-22683 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22683 · Vendor Advisory
• https://github.com/windmill-labs/windmill/releases/tag/v1.615.0 · Note
• https://windmill.dev · Note
• https://twitter.com/CveFindCom/status/2041572435590361120 · Twitter Post
• https://twitter.com/CVEnew/status/2041569970027688019 · Twitter Post
• https://t.me/CSIRT_italia/3354 · Telegram Post
• https://apps.nextcloud.com/apps/flow/releases · Note