{"id":"CVE-2026-72541","summary":"Windmill Labs Windmill - Missing Authorization","details":"A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the update_resource_type endpoint. The endpoint omits the administrator permission check that the corresponding delete_resource_type endpoint enforces. An attacker with workspace member privileges can corrupt resource type definitions, breaking workflows that depend on them.","modified":"2026-08-14T11:54:03.228939387Z","published":"2026-08-11T11:08:18.654Z","database_specific":{"cna_assigner":"TuranSec","cwe_ids":["CWE-306"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72541.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72541.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72541"},{"type":"PACKAGE","url":"https://github.com/windmill-labs/windmill"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/windmill-labs/windmill","events":[{"introduced":"0"},{"fixed":"099efa358aa615dcd1cbba45cfb7d7b4d9a411e0"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"1.783.0"},{"fixed":"1.783.0"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["v1.782.0","v1.781.1","v1.781.3","v1.781.2","v1.781.0","v1.780.0","v1.779.0","v1.778.0","v1.777.1","v1.777.0","v1.776.0","v1.775.2","v1.775.1","v1.775.0","v1.774.0","v1.773.0","v1.772.0","v1.771.1","v1.771.0","v1.770.0","v1.769.0","v1.768.0","v1.767.0","v1.766.2","v1.766.1","v1.766.0","v1.765.0","v1.764.0","v1.763.0","v1.762.2","v1.761.0","v1.762.0","v1.762.1","v1.757.0","v1.760.1","v1.760.0","v1.756.0","v1.759.0","v1.758.0","v1.756.1","v1.755.0","v1.754.0","v1.751.0","v1.753.0","v1.752.0","v1.750.0","v1.749.0","v1.748.0","v1.747.0","v1.746.0","v1.742.0","v1.745.0","v1.744.0","v1.743.0","v1.741.0","v1.740.0","v1.733.1","v1.739.0","v1.735.0","v1.738.0","v1.737.0","v1.734.0","v1.736.0","v1.733.0","v1.732.0","v1.730.0","v1.731.0","v1.729.0","v1.728.1","v1.728.0","v1.727.0","v1.726.1","v1.726.0","v1.725.1","v1.725.0","v1.724.0","v1.723.0","v1.721.0","v1.722.0","v1.719.0","v1.720.0","v1.718.0","v1.708.0","v1.717.1","v1.717.0","v1.716.0","v1.715.0","v1.714.1","v1.714.0","v1.713.1","v1.713.0","v1.710.0","v1.712.0","v1.711.0","v1.710.1","v1.709.0","v1.707.0","v1.706.1","v1.706.0","v1.705.0","v1.704.1","v1.704.0","v1.703.1","v1.703.3","v1.703.2","v1.703.0","v1.702.1","v1.702.0","v1.701.0","v1.696.1","v1.700.2","v1.700.1","v1.700.0","v1.697.0","v1.699.0","v1.698.0","v1.696.2","v1.696.0","v1.695.0","v1.694.0","v1.693.4","v1.693.3","v1.693.2","v1.693.1","v1.693.0","v1.692.0","v1.691.1","v1.691.0","v1.690.0","v1.689.0","v1.688.0","v1.687.0","v1.686.0","v1.685.0","v1.684.1","v1.684.0","v1.683.2","v1.683.1","v1.683.0","v1.682.0","v1.681.0","v1.680.0","v1.677.0","v1.679.0","v1.678.0","v1.675.0","v1.676.0","v1.675.1","v1.674.2","v1.674.1","v1.674.0","v1.673.0","v1.670.0","v1.672.0","v1.671.0","v1.669.1","v1.669.0","v1.668.5","v1.668.4","v1.668.3","v1.668.2","v1.668.1","v1.668.0","v1.667.0","v1.666.0","v1.665.0","v1.664.0","v1.663.0","v1.662.0","v1.661.0","v1.660.1","v1.660.0","v1.659.1","v1.659.0","v1.658.0","v1.657.2","v1.657.1","v1.657.0","v1.656.0","v1.655.0","v1.653.0","v1.654.0","v1.652.0","v1.651.1","v1.651.0","v1.650.0","v1.649.0","v1.648.0","v1.647.1","v1.647.2","v1.647.0","v1.646.0","v1.645.0","v1.644.0","v1.643.0","v1.642.0","v1.641.0","v1.640.0","v1.638.3","v1.639.0","v1.638.4","v1.638.2","v1.638.1","v1.638.0","v1.637.0","v1.636.0","pr-assets","v1.635.1","v1.635.0","v1.634.6","v1.634.5","v1.634.4","v1.634.3","v1.634.2","v1.634.1","v1.634.0","v1.633.1","v1.633.0","v1.632.0","v1.631.2","v1.631.1","v1.631.0","v1.630.2","v1.630.1","v1.630.0","v1.629.1","v1.629.0","v1.628.3","v1.628.2","v1.628.1","v1.628.0","v1.627.0","v1.626.0","v1.625.0","v1.624.0","v1.623.1","v1.623.0","v1.622.0","v1.621.2","v1.621.1","v1.621.0","v1.620.1","v1.620.0","v1.619.0","v1.618.2","v1.618.1","v1.618.0","v1.617.3","v1.617.2","v1.617.1","v1.617.0","v1.616.0","v1.615.3","v1.615.2","v1.615.1","v1.615.0","v1.614.0","v1.613.4","v1.613.3","v1.613.2","v1.613.1","v1.613.0","v1.612.2","v1.612.1","v1.612.0","v1.611.0","v1.610.1","v1.610.0","v1.609.0","v1.608.0","v1.607.1","v1.607.0","v1.606.1","v1.606.0","v1.605.0","v1.604.0","v1.603.4","v1.603.3","v1.603.2","v1.603.1","v1.603.0","v1.602.0","v1.601.1","v1.601.0","v1.600.1","v1.600.0","v1.599.3","v1.599.2","v1.599.1","v1.599.0","v1.598.0","v1.597.1","v1.597.0","v1.596.0","v1.595.0","v1.594.0","v1.593.1","v1.593.0","v1.592.1","v1.592.0","v1.591.4","v1.591.3","v1.591.2","v1.591.1","v1.591.0","v1.590.0","v1.589.3","v1.589.2","v1.589.1","v1.589.0","v1.588.0","v1.587.1","v1.587.0","v1.586.0","v1.585.1","v1.585.0","v1.584.0","v1.583.3","v1.583.2","v1.583.0","v1.583.1","v1.582.2","v1.582.1","v1.582.0","v1.581.1","v1.581.0","v1.580.0","v1.579.2","v1.579.1","v1.579.0","v1.578.0","v1.577.0","v1.576.3","v1.576.2","v1.576.1","v1.576.0","v1.575.4","v1.575.3","v1.575.2","v1.575.1","v1.575.0","v1.574.3","v1.574.2","v1.574.1","v1.574.0","v1.573.5","v1.573.4","v1.573.3","v1.573.2","v1.573.1","v1.573.0","v1.572.2","v1.572.1","v1.572.0","v1.571.0","v1.570.0","v1.569.0","v1.568.0","v1.567.3","v1.566.1","v1.567.2","v1.567.1","v1.567.0","v1.566.0","v1.565.0","v1.564.0","v1.563.4","v1.563.3","v1.563.2","v1.563.1","v1.563.0","v1.562.0","v1.561.0","v1.560.0","v1.559.0","v1.558.1","v1.558.0","v1.557.0","v1.556.1","v1.556.0","v1.555.2","v1.555.1","v1.555.0","v1.554.1","v1.554.0","v1.553.0","v1.552.1","v1.552.0","v1.551.4","v1.551.3","v1.551.2","v1.551.1","v1.551.0","v1.550.0","v1.549.1","v1.549.0","v1.548.3","v1.548.2","v1.548.1","v1.548.0","v1.547.0","v1.546.1","v1.546.0","v1.545.0","v1.544.2","v1.544.1","v1.544.0","v1.543.0","v1.542.4","v1.542.3","v1.542.2","v1.542.1","v1.542.0","v1.541.1","v1.541.0","v1.540.2","v1.540.1","v1.540.0","v1.539.1","v1.539.0","v1.538.0","v1.537.1","v1.537.0","v1.536.0","v1.535.0","v1.534.1","v1.534.0","v1.533.1","v1.533.0","v1.532.0","v1.531.0","v1.530.0","v1.529.0","v1.528.0","v1.527.1","v1.527.0","v1.526.1","v1.526.0","v1.525.0","v1.524.0","v1.523.0","v1.522.1","v1.522.0","v1.521.0","v1.520.1","v1.520.0","v1.519.2","v1.519.1","v1.519.0","v1.518.2","v1.518.1","v1.518.0","v1.517.0","v1.516.0","v1.515.1","v1.515.0","v1.514.1","v1.514.0","v1.513.1","v1.513.0","v1.512.0","v1.511.0","v1.510.1","v1.510.0","v1.509.2","v1.509.1","v1.509.0","v1.508.0","v1.507.2","v1.507.1","v1.507.0","v1.506.0","v1.505.4","v1.505.3","v1.505.2","v1.505.1","v1.505.0","v1.504.0","v1.503.3","v1.503.2","v1.503.1","v1.503.0","v1.502.2","v1.502.1","v1.502.0","v1.501.4","v1.501.3","v1.501.2","v1.501.1","v1.501.0","v1.500.3","v1.500.2","v1.500.1","v1.500.0","v1.499.0","v1.498.0","v1.497.2","v1.497.1","v1.497.0","v1.496.3","v1.496.2","v1.496.1","v1.496.0","v1.495.1","v1.495.0","v1.494.0","v1.493.4","v1.493.3","v1.493.2","v1.493.1","v1.493.0","v1.492.1","v1.492.0","v1.491.5","v1.491.4","v1.491.3","v1.491.2","v1.491.1","v1.491.0","v1.490.0","v1.489.0","v1.488.0","v1.487.0","v1.486.1","v1.486.0","v1.485.3","v1.485.2","v1.485.1","v1.485.0","v1.484.0","v1.483.2","v1.483.1","v1.483.0","v1.482.1","v1.482.0","v1.481.0","v1.480.1","v1.480.0","v1.479.3","v1.479.2","v1.479.1","v1.479.0","v1.478.1","v1.478.0","v1.477.1","v1.477.0","v1.476.0","v1.475.1","v1.475.0","v1.474.0","v1.473.1","v1.473.0","v1.472.1","v1.472.0","v1.471.1","v1.471.0","v1.470.1","v1.470.0","v1.469.0","v1.467.1","v1.468.0","v1.467.0","v1.466.3","v1.466.2","v1.466.1","v1.466.0","v1.465.0","v1.464.0","v1.463.6","v1.463.5","1.463.5","1.463.4","v1.463.0","v1.463.3","v1.463.2","v1.463.1","1.462.4","1.462.3","1.462.2","1.422.3","v1.462.1","v1.462.0","v1.461.1","v1.461.0","v1.460.1","v1.460.0","v1.459.0","v1.458.4","v1.458.3","v1.458.2","v1.458.1","v1.458.0","v1.457.1","v1.457.0","v1.456.0","v1.455.2","v1.455.1","v1.455.0","v1.454.1","v1.454.0","v1.453.1","v1.453.0","v1.452.1","v1.452.0","v1.451.0","v1.450.1","v1.450.0","v1.449.3","v1.449.2","v1.449.1","v1.449.0","v1.448.1","v1.448.0","v1.447.6","v1.447.5","v1.447.4","v1.447.3","v1.447.2","v1.447.1","v1.447.0","v1.446.0","v1.445.1","v1.445.0","v1.444.0","v1.443.0","v1.442.0","v1.441.2","v1.441.1","v1.441.0","v1.440.3","v1.440.2","v1.440.1","v1.440.0","v1.439.0","v1.438.0","v1.437.1","v1.437.0","v1.436.0","v1.435.2","v1.435.1","v1.435.0","v1.434.2","v1.434.1","v1.434.0","v1.433.0","v1.432.0","v1.431.1","v1.431.0","v1.430.2","v1.430.1","v1.430.0","v1.429.0","v1.428.1","v1.428.0","v1.427.0","v1.426.1","v1.426.0","v1.425.1","v1.425.0","v1.424.0","v1.423.2","v1.423.1","v1.423.0","v1.422.1","v1.422.0","v1.421.2","v1.421.1","v1.421.0","v1.420.1","v1.420.0","v1.419.0","v1.418.0","v1.417.3","v1.417.2","v1.417.1","v1.417.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72541.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"}]}