Skip to content
Threat Feed

Tag

Windmill

2 briefs RSS
critical advisory

Windmill Missing Authorization Vulnerability (CVE-2026-22683)

Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability (CVE-2026-22683) that allows users with the Operator role to bypass intended restrictions and perform unauthorized entity creation and modification actions via the backend API, potentially leading to privilege escalation and remote code execution.

windmill authorization-bypass privilege-escalation remote-code-execution
2r 2t 1c
critical advisory

Windmill CE/EE SQL Injection Vulnerability

Windmill CE/EE versions 1.276.0 through 1.603.2 are vulnerable to SQL injection in the folder ownership management, allowing authenticated attackers to inject SQL through the owner parameter, leading to sensitive data access, token forgery, and arbitrary code execution.

sql-injection rce windmill
2r 3t 1c