CVE-2026-22683

OVERVIEW CVE-2026-22683 affects Windmill versions 1.56.0 through 1.614.0 and involves a missing authorization vulnerability in the backend API. Users assigned the Operator role can perform prohibited entity creation and modification actions, including creating and updating scripts, flows, apps, and raw applications, despite documentation and pricing restrictions that explicitly prevent such actions. This vulnerability exists due to insufficient API enforcement of role-based access controls on workspace endpoints. SEVERITY The vulnerability carries a CVSS score of 8.8 (High) with a network-based attack vector requiring only low complexity and low privileges. No user interaction is required. The impact is severe across all three dimensions: attackers can achieve high confidentiality impact, high integrity impact, and high availability impact. Most critically, since Operators can execute scripts via the Windmill jobs API, this authorization bypass enables direct privilege escalation to remote code execution within the affected deployment environment. EXPLOITATION STATUS The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog and remains inactive on threat tracking lists. The EPSS score of 0.0028 indicates minimal probability of exploitation in the wild relative to other disclosed vulnerabilities. However, the straightforward nature of the vulnerability and its direct path to remote code execution suggest that proof-of-concept exploitation would be relatively straightforward for motivated threat actors, warranting close monitoring.