CVE-2026-22683 describes a missing authorization vulnerability in Windmill Labs Windmill CE (Community Edition) affecting versions 1.56.0 through 1.614.0. The flaw allows users assigned the Operator role, which is documented and priced as restricted from creating or modifying entities, to bypass these restrictions via the backend API. Specifically, the API does not enforce Operator role limitations on workspace endpoints, enabling unauthorized creation and modification of scripts, flows, apps, and raw_apps. Given that Operators can execute scripts through the jobs API, this vulnerability enables direct privilege escalation to remote code execution within the affected Windmill deployment. The vulnerability has been present since the introduction of the Operator role in version 1.56.0. No official patch or remediation level has been published by the vendor as of the provided data.

The vulnerability allows an Operator role user to bypass intended authorization restrictions, enabling unauthorized creation and modification of critical entities such as scripts and applications. This unauthorized capability, combined with the ability to execute scripts, results in direct privilege escalation to remote code execution within the Windmill CE environment. This can lead to full compromise of the affected system. The CVSS 4.0 base score is 8.7 (high severity), reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Windmill Labs communications for updates. Until a patch is available, restrict Operator role assignments to trusted users only and consider limiting access to the backend API endpoints if possible. Avoid exposing the Windmill CE backend API to untrusted networks. No vendor advisory states that the issue is already mitigated or requires no action.