PT-2026-30914 · Nextcloud+1 · Flow+2

Valentin Lobstein · Published 2026-04-07 · Updated 2026-04-07 · CVE-2026-23696

NVD

CVSS v3.1

9.9

Critical

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Windmill CE and EE versions 1.276.0 through 1.603.2 contain an SQL injection vulnerability in the folder ownership management functionality that allows authenticated attackers to inject SQL through the owner parameter. An attacker can use the injection to read sensitive data such as the JWT signing secret and administrative user identifiers, forge an administrative token, and then execute arbitrary code via the workflow execution endpoints.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-23696

Affected Products

Flow

Windmill Ce

Windmill Ee

References · 8

• 🔥 https://github.com/Chocapikk/Windfall · Exploit
• 🔥 https://chocapikk.com/posts/2026/windfall-nextcloud-flow-windmill-rce · Exploit
• https://github.com/windmill-labs/windmill/commit/942fb629210ebb287f48467d1535ffde3a3eeafe · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-23696 · Security Note
• https://github.com/windmill-labs/windmill/releases/tag/v1.603.3 · Note
• https://apps.nextcloud.com/apps/flow/releases · Note
• https://windmill.dev · Note
• https://vulncheck.com/advisories/windmill-file-ownership-handling-sqli-rce · Note