This vulnerability (CWE-306) in Windmill Labs Windmill occurs because the update_resource_type endpoint does not enforce administrator-level authorization, unlike the delete_resource_type endpoint. As a result, any authenticated workspace member can modify resource type schemas, potentially corrupting them and breaking workflows that rely on these definitions. The vulnerability affects versions through 1.783.0. The CVSS 3.1 score is 6.5 (medium severity), with an attack vector of network, low attack complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No patch or remediation information is currently available.

An attacker with authenticated workspace member privileges can overwrite resource type schemas, leading to corruption of resource definitions. This can break workflows that depend on these schemas, impacting the integrity of the system's operations. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict workspace membership to trusted users only to minimize risk. Monitor for unusual modifications to resource type schemas as a precaution.