Is CVE-2026-72541 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-72541 being exploited in the wild.

How severe is CVE-2026-72541?

Medium severity, with a CVSS score of 6.5, published 11 August 2026.

Which products and versions are affected?

Windmill Labs Windmill through 1.783.0.

Is there a fix for CVE-2026-72541?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-72541 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-72541?

Check whether you run Windmill Labs Windmill at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-72541: Windmill Labs Windmill authorization bypass in resource type update

CVE-2026-72541 · Severity: medium · CVSS 6.5 · Published 2026-08-11

Windmill is an open-source workflow automation and infrastructure platform. A missing permission check in the resource type update endpoint allows any workspace member to modify resource definitions without administrator approval. An attacker with basic workspace access can corrupt resource schemas, breaking critical workflows that depend on those definitions and potentially causing operational disruption.

Technologies: Windmill Labs Windmill. Vendors: Windmill Labs.

Quick answers

Is CVE-2026-72541 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-72541 being exploited in the wild.
How severe is CVE-2026-72541?: Medium severity, with a CVSS score of 6.5, published 11 August 2026.
Which products and versions are affected?: Windmill Labs Windmill through 1.783.0.
Is there a fix for CVE-2026-72541?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-72541 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-72541?: Check whether you run Windmill Labs Windmill at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing authorization check (CWE-862) in the update_resource_type API endpoint. The endpoint fails to enforce the administrator permission requirement that its corresponding delete_resource_type endpoint properly validates. An authenticated workspace member can call the update endpoint to overwrite any resource type schema definition via a network request, without requiring elevated privileges. This allows corruption of resource definitions and breakage of dependent workflows. The vulnerability affects Windmill through version 1.783.0; a patch is expected in a subsequent release.

Affected products

Windmill Labs Windmill through 1.783.0

Timeline

2026-08-11: disclosed

References

https://github.com/windmill-labs/windmill

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.