CVE-2026-22683

Name: CVE-2026-22683
Creator: NVD / NIST
Published: 2026-04-07T17:16:27.037+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 8.7/10EPSS 0.68%

Last modified Jun 17, 2026

CVE-2026-22683 is a high-severity vulnerability rated 8.7/10 on the CVSS scale. Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities, the API does not enforce the Operator restriction on workspace endpoints, allowing an Operator to create and update scripts, flows, apps, and raw_apps. EPSS estimates a 0.68% chance of exploitation in the next 30 days.

Description

Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities, the API does not enforce the Operator restriction on workspace endpoints, allowing an Operator to create and update scripts, flows, apps, and raw_apps. Since Operators can also execute scripts via the jobs API, this allows direct privilege escalation to remote code execution within the Windmill deployment. This vulnerability has existed since the introduction of the Operator role in version 1.56.0.

Metrics

CVSS 3.1

8.8/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS 4.0

8.7/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Probability

0.68%

47.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-862

Affected Software

Vendor	Product	Versions
Nextcloud	Flow	>= 1.0.0, <= 1.2.2
Windmill	Windmill	>= 1.56.0, <= 1.614.0

References

https://apps.nextcloud.com/apps/flow/releasesRelease Notes
https://chocapikk.com/posts/2026/windfall-nextcloud-flow-windmill-rce/Vendor Advisory
https://github.com/Chocapikk/WindfallProduct
https://github.com/windmill-labs/windmill/commit/c621a74804f4f6e8318819c01e3a23a17698588bPatch
https://github.com/windmill-labs/windmill/releases/tag/v1.615.0Release Notes
https://www.windmill.dev/Product

Timeline

Published: Apr 7, 2026
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2026-22683?

How severe is CVE-2026-22683?

CVE-2026-22683 has a CVSS score of 8.7/10 (HIGH severity). The EPSS model estimates a 0.68% probability of exploitation in the next 30 days.

How do I fix CVE-2026-22683?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2026-22683?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST