Executive brief
Windmill is an open-source platform for creating and running workflows and automations. A missing authorization check allows authenticated operators to view job execution metrics and progress data for any job in their workspace, even jobs they don't own or have permission to access, and to inject false progress updates. This bypasses intended access controls and could expose sensitive job execution details across teams.
Technical details
The vulnerability is a missing authorization check in the job_metrics API handlers in Windmill through version 1.783.0. The handlers accept no authorization extractor, allowing any authenticated operator to bypass workspace-level access controls and read job metrics or write job progress updates for jobs they do not own. An authenticated attacker can enumerate and monitor sensitive job execution data and inject misleading progress information, but requires valid authentication and operator-level privileges to exploit the flaw.
Affected products
- Windmill Labs Windmill through 1.783.0
Timeline
- 2026-08-11: disclosed