CVE-2026-22683 Details
Description
Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities, the API does not enforce the Operator restriction on workspace endpoints, allowing an Operator to create and update scripts, flows, apps, and raw_apps. Since Operators can also execute scripts via the jobs API, this allows direct privilege escalation to remote code execution within the Windmill deployment. This vulnerability has existed since the introduction of the Operator role in version 1.56.0.
A vulnerability in Windmill versions 1.56.0 prior to 1.614.0, and in Nextcloud Flow versions 1.0.0 prior to 1.2.2, allows users with the Operator role to bypass authorization restrictions and perform unauthorized actions through the backend API. Operators can exploit this vulnerability to create and modify entities such as scripts, flows, apps, and raw apps, despite documentation stating that their role does not permit such actions. This exploitation leads to privilege escalation and remote code execution within the Windmill deployment, as Operators can execute scripts via the jobs API.
Users can update to Windmill version 1.615.0 and Nextcloud Flow version 1.3.0, both of which include patches for this vulnerability. However, organizations should also address the underlying architectural issues in Nextcloud Flow that allowed this vulnerability to be exploited.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nextcloud flow | >= 1.0.0, <= 1.2.2 |
CPE
Remediation
| |
| windmill windmill | >= 1.56.0, <= 1.614.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | Initial Analysis | [email protected] |
| Apr 7, 2026 | New CVE Received | [email protected] |