CVE-2026-22683 is a missing authorization vulnerability in Windmill Labs Windmill CE (Community Edition) affecting versions 1.56.0 through 1.614.0. The backend API does not enforce role-based restrictions for the Operator role on workspace endpoints, allowing Operators to perform unauthorized creation and modification of entities such as scripts, flows, apps, and raw_apps. Given that Operators can execute scripts via the jobs API, this leads to direct privilege escalation to remote code execution within the Windmill deployment. The vulnerability has been present since the Operator role was introduced in version 1.56.0. The CVSS 4.0 score is 8.7 (high severity), reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch available at this time.

An attacker with Operator role privileges can bypass intended authorization restrictions to create and modify entities, enabling escalation to remote code execution within the affected Windmill CE deployment. This compromises confidentiality, integrity, and availability of the system. The vulnerability allows privilege escalation from a limited Operator role to full code execution capabilities, posing a significant security risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Operator role assignments to trusted users only and consider limiting network exposure of the Windmill backend API to reduce risk. Monitor vendor channels for updates regarding patches or official mitigations.