The vulnerability identified as CVE-2026-72539 affects Windmill Labs Windmill through version 1.783.0. It involves an information disclosure flaw where legacy draft scripts without an assigned owner email bypass access control lists (ACLs). Any authenticated member of a workspace can query the drafts endpoint and receive these ownerless drafts, which contain plaintext resource credentials. This exposure allows unauthorized actors within the workspace to access sensitive information that should be restricted.

The impact of this vulnerability is the unauthorized disclosure of sensitive plaintext resource credentials to any authenticated workspace member. This could lead to credential compromise and potential misuse of resources that rely on these credentials. The CVSS 3.1 base score is 6.5 (medium severity), reflecting a network attack vector with low attack complexity, requiring privileges but no user interaction, and resulting in high confidentiality impact without integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Until a patch is available, restrict workspace membership to trusted users only and monitor for any unusual access patterns related to draft scripts. Follow vendor updates closely for any forthcoming patches or official mitigation instructions.