CVE-2026-22683: CWE-862 Missing Authorization in Windmill Labs Windmill CE (Community Edition)
Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities, the API does not enforce the Operator restriction on workspace endpoints, allowing an Operator to create and update scripts, flows, apps, and raw_apps. Since Operators can also execute scripts via the jobs API, this allows direct privilege escalation to remote code execution within the Windmill deployment. This vulnerability has existed since the introduction of the Operator role in version 1.56.0.
AI Analysis
Technical Summary
CVE-2026-22683 is a missing authorization vulnerability in Windmill Labs Windmill CE (Community Edition) affecting versions 1.56.0 through 1.614.0. The backend API does not enforce Operator role restrictions on workspace endpoints, allowing Operators to create and modify entities such as scripts, flows, apps, and raw_apps despite documentation and pricing indicating otherwise. Given that Operators can execute scripts via the jobs API, this leads to direct privilege escalation resulting in remote code execution within the Windmill environment. The vulnerability has been present since the Operator role was introduced in version 1.56.0. There is no vendor advisory or patch information available at this time.
Potential Impact
Users with the Operator role can bypass intended authorization restrictions to create and modify entities, which they are not supposed to do. This unauthorized capability combined with the ability to execute scripts allows privilege escalation to remote code execution within the affected Windmill deployment. This could lead to full compromise of the affected system.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Operator role assignments to trusted users only and consider limiting access to the backend API endpoints if possible. Monitor for vendor updates regarding patches or official mitigations.
CVE-2026-22683: CWE-862 Missing Authorization in Windmill Labs Windmill CE (Community Edition)
Description
Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities, the API does not enforce the Operator restriction on workspace endpoints, allowing an Operator to create and update scripts, flows, apps, and raw_apps. Since Operators can also execute scripts via the jobs API, this allows direct privilege escalation to remote code execution within the Windmill deployment. This vulnerability has existed since the introduction of the Operator role in version 1.56.0.
CVSS v4.0
Score 8.7high
Affected software
pkg:github/windmill-labs/windmillRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-22683 is a missing authorization vulnerability in Windmill Labs Windmill CE (Community Edition) affecting versions 1.56.0 through 1.614.0. The backend API does not enforce Operator role restrictions on workspace endpoints, allowing Operators to create and modify entities such as scripts, flows, apps, and raw_apps despite documentation and pricing indicating otherwise. Given that Operators can execute scripts via the jobs API, this leads to direct privilege escalation resulting in remote code execution within the Windmill environment. The vulnerability has been present since the Operator role was introduced in version 1.56.0. There is no vendor advisory or patch information available at this time.
Potential Impact
Users with the Operator role can bypass intended authorization restrictions to create and modify entities, which they are not supposed to do. This unauthorized capability combined with the ability to execute scripts allows privilege escalation to remote code execution within the affected Windmill deployment. This could lead to full compromise of the affected system.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Operator role assignments to trusted users only and consider limiting access to the backend API endpoints if possible. Monitor for vendor updates regarding patches or official mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-01-08T19:04:26.365Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d53bdbaaed68159a38bda5
Added to database: 04/07/2026, 17:16:11 UTC
Last enriched: 07/15/2026, 11:03:36 UTC
Last updated: 07/31/2026, 19:22:57 UTC
Views: 105
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.