CVE-2026-72541: Windmill Labs Windmill

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the update_resource_type endpoint. The endpoint omits the administrator permission check that the corresponding delete_resource_type endpoint enforces. An attacker with workspace member privileges can corrupt resource type definitions, breaking workflows that depend on them.

Affected products

• Windmill Labs Windmill: up to and including 1.783.0

Published 2026-08-11. Last modified 2026-09-03.