CVE-2026-22683
Last modified
CVE-2026-22683 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities, the API does not enforce the Operator restriction on workspace endpoints, allowing an Operator to create and update scripts, flows, apps, and raw_apps. EPSS estimates a 0.68% chance of exploitation in the next 30 days.
Description
Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities, the API does not enforce the Operator restriction on workspace endpoints, allowing an Operator to create and update scripts, flows, apps, and raw_apps. Since Operators can also execute scripts via the jobs API, this allows direct privilege escalation to remote code execution within the Windmill deployment. This vulnerability has existed since the introduction of the Operator role in version 1.56.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Nextcloud | Flow | >= 1.0.0, <= 1.2.2 |
| Windmill | Windmill | >= 1.56.0, <= 1.614.0 |
References
- https://apps.nextcloud.com/apps/flow/releasesRelease Notes
- https://www.windmill.dev/Product
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-22683?
How severe is CVE-2026-22683?
How do I fix CVE-2026-22683?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-22677Hermes WebUI prior to 0.51.44 contains a path traversal vuln…6.5
- CVE-2026-22678Webmin before 2.641 contains a stored cross-site scripting v…5.4
- CVE-2026-22679Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 con…9.8
- CVE-2026-2268The Ninja Forms plugin for WordPress is vulnerable to Sensit…7.5
- CVE-2026-22680OpenViking versions prior to 0.3.3 contain a missing authori…6.9
- CVE-2026-22682OpenHarness prior to commit 166fcfe contains an improper acc…8.4
- CVE-2026-22685DevToys is a desktop app for developers. In versions from 2.…9.8
- CVE-2026-22686Enclave is a secure JavaScript sandbox designed for safe AI …10
- CVE-2026-22687WeKnora is an LLM-powered framework designed for deep docume…9.8
- CVE-2026-22688WeKnora is an LLM-powered framework designed for deep docume…8.8
- CVE-2026-22689Mailpit is an email testing tool and API for developers. Pri…6.5
- CVE-2026-2269The Uncanny Automator – Easy Automation, Integration, Webhoo…7.2
Are you affected by CVE-2026-22683?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST