Approved changes feed: RSS · Atom
cpe:2.3:a:windmill_labs:windmill:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Windmill Labs (7d89704b-7f5a-5b72-b6c9-e4b5f2df9be0) |
|---|---|
| Product | Windmill (8a290d2a-861f-5e11-91ff-02c7581dfb9d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-72542 |
vulnerable | 2026-09-16 04:33:09.304759 |
Windmill Labs Windmill - Missing Authorization
MEDIUM (5.4)
A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write job progress and read job metrics for any job in the workspace regardless of ownership. The job_metrics handlers accept no authorization extractor, bypassing workspace-level access controls. An operator can monitor sensitive job execution data and inject misleading progress for jobs they do not own.
Published: 2026-08-11T11:08:33.253Z
Updated: 2026-08-11T12:33:47.646Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-72539 |
vulnerable | 2026-09-16 04:33:09.226954 |
Windmill Labs Windmill - Information Disclosure
MEDIUM (6.5)
An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that contain plaintext resource credentials. Drafts with a null owner email bypass ACL enforcement and are returned to any workspace member who queries the drafts endpoint. Sensitive credentials stored in these drafts are exposed across ACL boundaries.
Published: 2026-08-11T11:07:47.709Z
Updated: 2026-08-11T12:37:03.236Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-72541 |
vulnerable | 2026-09-16 04:33:08.892141 |
Windmill Labs Windmill - Missing Authorization
MEDIUM (6.5)
A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the update_resource_type endpoint. The endpoint omits the administrator permission check that the corresponding delete_resource_type endpoint enforces. An attacker with workspace member privileges can corrupt resource type definitions, breaking workflows that depend on them.
Published: 2026-08-11T11:08:18.654Z
Updated: 2026-08-11T12:35:22.374Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.