CVE-2026-23696

{
  "id": "CVE-2026-23696",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-07T17:16:27.247",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Windmill CE and EE versions 1.276.0 through 1.603.2 contain an SQL injection vulnerability in the folder ownership management functionality that allows authenticated attackers to inject SQL through the owner parameter. An attacker can use the injection to read sensitive data such as the JWT signing secret and administrative user identifiers, forge an administrative token, and then execute arbitrary code via the workflow execution endpoints."
    },
    {
      "lang": "es",
      "value": "Las versiones 1.276.0 a 1.603.2 de Windmill CE y EE contienen una vulnerabilidad de inyección SQL en la funcionalidad de gestión de propiedad de carpetas que permite a atacantes autenticados inyectar SQL a través del parámetro owner. Un atacante puede usar la inyección para leer datos sensibles como el secreto de firma JWT y los identificadores de usuario administrativo, forjar un token administrativo y luego ejecutar código arbitrario a través de los puntos finales de ejecución de flujo de trabajo."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Windmill Labs",
          "product": "Windmill CE (Community Edition)",
          "defaultStatus": "unaffected",
          "repo": "https://github.com/windmill-labs/windmill",
          "packageURL": "pkg:github/windmill-labs/windmill",
          "versions": [
            {
              "version": "1.276.0",
              "lessThanOrEqual": "1.603.2",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "1.603.3",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Windmill Labs",
          "product": "Windmill EE (Enterprise Edition)",
          "defaultStatus": "unaffected",
          "repo": "https://github.com/windmill-labs/windmill",
          "packageURL": "pkg:github/windmill-labs/windmill",
          "versions": [
            {
              "version": "1.276.0",
              "lessThanOrEqual": "1.603.2",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "1.603.3",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 9.4,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "subAvailabilityImpact": "HIGH",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-07T00:00:00+00:00",
          "id": "CVE-2026-23696",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://apps.nextcloud.com/apps/flow/releases",
      "source": "[email protected]"
    },
    {
      "url": "https://chocapikk.com/posts/2026/windfall-nextcloud-flow-windmill-rce/",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/Chocapikk/Windfall",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/windmill-labs/windmill/commit/942fb629210ebb287f48467d1535ffde3a3eeafe",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/windmill-labs/windmill/releases/tag/v1.603.3",
      "source": "[email protected]"
    },
    {
      "url": "https://www.vulncheck.com/advisories/windmill-file-ownership-handling-sqli-rce",
      "source": "[email protected]"
    },
    {
      "url": "https://www.windmill.dev/",
      "source": "[email protected]"
    }
  ]
}