---
id: CVE-2026-22683
title: Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE
summary: >-
  Windmill versions 1.56.0 through 1.614.0 contain a missing authorization
  vulnerability that allows users with the Operator role to perform prohibited
  entity creation and modification actions via the backend API. Although
  Operators are do…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-862
vendor: Windmill Labs
product: Windmill CE (Community Edition)
affected:
  - windmill_ce_community_edition >= 1.56.0 <= 1.614.0
  - windmill_ee_enterprise_edition >= 1.56.0 <= 1.614.0
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-04-08T03:55:45.209485Z'
exploitAvailable: true
published: '2026-04-07'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:01:21.427Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-22683'
references:
  - url: 'https://chocapikk.com/posts/2026/windfall-nextcloud-flow-windmill-rce/'
  - url: 'https://github.com/Chocapikk/Windfall'
  - url: 'https://github.com/windmill-labs/windmill/releases/tag/v1.615.0'
    label: Windmill 1.615.0 Release Notes
  - url: >-
      https://github.com/windmill-labs/windmill/commit/c621a74804f4f6e8318819c01e3a23a17698588b
  - url: 'https://www.windmill.dev/'
  - url: 'https://apps.nextcloud.com/apps/flow/releases'
tags:
  - cve.org
  - exploit-available
epss: 0.02609
epssPercentile: 0.85504
exploits:
  nuclei:
    - CVE-2026-22683
  checkedAt: '2026-11-08T14:51:57.352Z'
ingestedAt: '2026-11-08T14:51:22.474Z'
---

## Overview

Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities, the API does not enforce the Operator restriction on workspace endpoints, allowing an Operator to create and update scripts, flows, apps, and raw_apps. Since Operators can also execute scripts via the jobs API, this allows direct privilege escalation to remote code execution within the Windmill deployment. This vulnerability has existed since the introduction of the Operator role in version 1.56.0.

## Affected

- `windmill_ce_community_edition >= 1.56.0 <= 1.614.0`
- `windmill_ee_enterprise_edition >= 1.56.0 <= 1.614.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.