Skip to content
Fencer Vulns
high 8.8

CVE-2026-22683 json

Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE

published 2026-04-07 7 mo ago modified 2026-11-08 19 h ago also EUVD-2026-19747

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.6%
EPSS 2.6% chance of exploitation in 30 days, percentile 85%
public exploits
0
none known, plus a Nuclei check

Summary

Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities, the API does not enforce the Operator restriction on workspace endpoints, allowing an Operator to create and update scripts, flows, apps, and raw_apps. Since Operators can also execute scripts via the jobs API, this allows direct privilege escalation to remote code execution within the Windmill deployment. This vulnerability has existed since the introduction of the Operator role in version 1.56.0.

Patch / fix

  • Windmill Labs Windmill CE (Community Edition) 1.615.0
  • Windmill Labs Windmill EE (Enterprise Edition) 1.615.0

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
7 mo ago

Exploit prediction

2.61% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Nuclei template Windmill < 1.603.3 - Operator Authorization Bypass nuclei detection template
  • chocapikk.com https://chocapikk.com/posts/2026/windfall-nextcloud-flow-windmill-rce/ referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/Chocapikk/Windfall referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • Windmill Labs Windmill CE (Community Edition)
  • Windmill Labs Windmill EE (Enterprise Edition)

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.