What is the CVSS score of EUVD-2026-56011?

EUVD-2026-56011 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Windmill EUVD-2026-56011

| CVE-2026-72541 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-08-11 TuranSec

GHSA-m628-hrwj-47mg

Authentication Bypass Windmill Windmill Labs

6.5

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.1 HIGH

Availability set to Low rather than None because corrupting resource type schemas demonstrably breaks dependent workflows; all other metrics from the provided vector are appropriate.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 12:25 vuln.today

DescriptionCVE.org

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the update_resource_type endpoint. The endpoint omits the administrator permission check that the corresponding delete_resource_type endpoint enforces. An attacker with workspace member privileges can corrupt resource type definitions, breaking workflows that depend on them.

AnalysisAI

Broken authorization on the update_resource_type endpoint in Windmill through 1.783.0 allows any authenticated workspace member to overwrite resource type schemas without administrator privileges. The delete_resource_type endpoint on the same platform correctly enforces an admin permission check, but the update counterpart omits it entirely, creating an inconsistent and exploitable trust boundary. No public exploit is identified at time of analysis and the vulnerability is absent from CISA KEV, but integrity of all resource type definitions - and the workflows depending on them - is at risk from any workspace member account.

Technical ContextAI

Windmill (Windmill Labs) is an open-source developer platform for building internal tools, scripts, and workflow automations, where 'resource types' define schemas for shared resources such as database connections, API credentials, and third-party service configurations. The root cause maps to CWE-306 (Missing Authentication for Critical Function): the REST endpoint update_resource_type, which modifies these schemas, does not enforce the administrator role check that its sibling endpoint delete_resource_type correctly applies. This creates a privilege asymmetry where deletion is gated but mutation - potentially more dangerous for silent sabotage - is not. All versions up to and including 1.783.0 are affected per CPE cpe:2.3:a:windmill_labs:windmill:*:*:*:*:*:*:*:* and EUVD-2026-56011.

RemediationAI

Monitor the Windmill upstream repository at https://github.com/windmill-labs/windmill for a patched release exceeding 1.783.0 and upgrade immediately upon availability; no specific fix version has been independently confirmed from the provided data, so treat any release above 1.783.0 as requiring validation against the changelog. As a compensating control pending a patch, audit all workspace members and remove or suspend any accounts that do not require ongoing access, since exploitation requires only workspace membership. Administrators should also review audit logs for unexpected or bulk calls to the update_resource_type endpoint and alert on anomalies. If Windmill is deployed in a multi-tenant context with untrusted members, consider temporarily disabling workspace self-enrollment and restricting membership changes to administrators only; this does not eliminate the endpoint vulnerability but limits the attacker pool. No network-level mitigation fully compensates without restricting API access to trusted IP ranges, which may break legitimate remote workflows.