Is CVE-2026-72541 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-72541?

CVE-2026-72541 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-72541

Description

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the update_resource_type endpoint. The endpoint omits the administrator permission check that the corresponding delete_resource_type endpoint enforces. An attacker with workspace member privileges can corrupt resource type definitions, breaking workflows that depend on them.