CVE-2026-72541: Windmill Labs Windmill - Missing Authorization
A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the updateresourcetype endpoint. The endpoint omits the administrator permission check that the corresponding deleteresourcetype endpoint enforces. An attacker with workspace member privileges can corrupt resource type definitions, breaking workflows that depend on them.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Windmill Labs Windmillto a version that resolves this vulnerability.Fixed in 1.783.0 - Compensating control
Restrict access to the Windmill update_resource_type endpoint so only users with administrator privileges can call it, since the endpoint is missing the admin permission check that delete_resource_type enforces.