CVE-2026-22683

{
  "id": "CVE-2026-22683",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-07T17:16:27.037",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities, the API does not enforce the Operator restriction on workspace endpoints, allowing an Operator to create and update scripts, flows, apps, and raw_apps. Since Operators can also execute scripts via the jobs API, this allows direct privilege escalation to remote code execution within the Windmill deployment. This vulnerability has existed since the introduction of the Operator role in version 1.56.0."
    },
    {
      "lang": "es",
      "value": "Las versiones de Windmill 1.56.0 a 1.614.0 contienen una vulnerabilidad de autorización ausente que permite a los usuarios con el rol de Operador realizar acciones prohibidas de creación y modificación de entidades a través de la API de backend. Aunque los Operadores están documentados y se les tarifa como incapaces de crear o modificar entidades, la API no aplica la restricción de Operador en los puntos finales del espacio de trabajo, permitiendo a un Operador crear y actualizar scripts, flujos, aplicaciones y raw_apps. Dado que los Operadores también pueden ejecutar scripts a través de la API de trabajos, esto permite una escalada directa de privilegios a la ejecución remota de código dentro del despliegue de Windmill. Esta vulnerabilidad ha existido desde la introducción del rol de Operador en la versión 1.56.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Windmill Labs",
          "product": "Windmill CE (Community Edition)",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "1.56.0",
              "lessThanOrEqual": "1.614.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "1.615.0",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Windmill Labs",
          "product": "Windmill EE (Enterprise Edition)",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "1.56.0",
              "lessThanOrEqual": "1.614.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "1.615.0",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-08T03:55:45.209485Z",
          "id": "CVE-2026-22683",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nextcloud:flow:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.0.0",
              "versionEndIncluding": "1.2.2",
              "matchCriteriaId": "390C858F-42E9-41D5-AE97-11242088C2F0"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:windmill:windmill:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.56.0",
              "versionEndIncluding": "1.614.0",
              "matchCriteriaId": "DC07ED1D-F0A4-4A59-AA24-52BF463E7D2D"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://apps.nextcloud.com/apps/flow/releases",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://chocapikk.com/posts/2026/windfall-nextcloud-flow-windmill-rce/",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/Chocapikk/Windfall",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://github.com/windmill-labs/windmill/commit/c621a74804f4f6e8318819c01e3a23a17698588b",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/windmill-labs/windmill/releases/tag/v1.615.0",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://www.windmill.dev/",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    }
  ]
}