Tag
critical
advisory
Windmill Missing Authorization Vulnerability (CVE-2026-22683)
2 rules 2 TTPs 1 CVEWindmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability (CVE-2026-22683) that allows users with the Operator role to bypass intended restrictions and perform unauthorized entity creation and modification actions via the backend API, potentially leading to privilege escalation and remote code execution.
windmill
authorization-bypass
privilege-escalation
remote-code-execution
2r
2t
1c
critical
advisory
Windmill CE/EE SQL Injection Vulnerability
2 rules 3 TTPs 1 CVEWindmill CE/EE versions 1.276.0 through 1.603.2 are vulnerable to SQL injection in the folder ownership management, allowing authenticated attackers to inject SQL through the owner parameter, leading to sensitive data access, token forgery, and arbitrary code execution.
sql-injection
rce
windmill
2r
3t
1c