CVE-2026-72541

The vulnerability in Windmill through 1.783.0 is straightforward: the update_resource_type endpoint lacks the administrator permission check that its delete_resource_type counterpart correctly enforces. An authenticated user with basic platform access can corrupt shared resource type definitions—schema contracts that dozens of downstream workflows depend on. This isn't just data modification; it's infrastructure sabotage that breaks every workflow consuming that resource type. The critical detail is the asymmetry. The development team clearly understood that deleting resource types required protection—the delete endpoint has the admin gate. Yet the equivalent modification operation, which can reshape schema contracts with identical downstream impact, carries no such restriction. This reveals a permission model built on reactive intuition rather than systematic architecture: developers secured what felt irreversibly dangerous while leaving what felt like benign editing unprotected. The practical risk extends beyond direct damage. Low-privilege users can disrupt collaborative infrastructure without needing to steal anything—they simply reshape a shared schema and walk away. The CVSS 6.5 rating is misleading because it treats this as a medium-severity data incident rather than the workspace-level infrastructure failure it actually represents. Resource types are hub entities in a dependency graph; corrupting one cascades to every workflow that references it. Prioritize patching update_resource_type with the same admin requirement delete_resource_type enforces. Beyond that single fix, treat this as a signal to audit other mutation endpoints in your Windmill deployment for the same asymmetric pattern—the permission model is likely scattered across individual handlers rather than defined as a composable policy, which means this is probably not an isolated oversight.

Reviewed through automated stages and approved by a human before publication.