Executive brief
Windmill is an open-source workflow automation and infrastructure platform. A missing permission check in the resource type update endpoint allows any workspace member to modify resource definitions without administrator approval. An attacker with basic workspace access can corrupt resource schemas, breaking critical workflows that depend on those definitions and potentially causing operational disruption.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the update_resource_type API endpoint. The endpoint fails to enforce the administrator permission requirement that its corresponding delete_resource_type endpoint properly validates. An authenticated workspace member can call the update endpoint to overwrite any resource type schema definition via a network request, without requiring elevated privileges. This allows corruption of resource definitions and breakage of dependent workflows. The vulnerability affects Windmill through version 1.783.0; a patch is expected in a subsequent release.
Affected products
- Windmill Labs Windmill through 1.783.0
Timeline
- 2026-08-11: disclosed