CVE-2026-23696
published 2026-04-07CVE-2026-23696: Windmill CE and EE versions 1.276.0 through 1.603.2 contain an SQL injection vulnerability in the folder ownership management functionality that allows…
PriorityP277critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAH
EXPLOIT
EPSS
13.58%
96.3th percentile
Windmill CE and EE versions 1.276.0 through 1.603.2 contain an SQL injection vulnerability in the folder ownership management functionality that allows authenticated attackers to inject SQL through the owner parameter. An attacker can use the injection to read sensitive data such as the JWT signing secret and administrative user identifiers, forge an administrative token, and then execute arbitrary code via the workflow execution endpoints.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| windmill_labs | windmill_ce | 1.276.0 – 1.603.2 | — |
| windmill_labs | windmill_ee | 1.276.0 – 1.603.2 | — |
CVSS provenance
nvdv3.19.9CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
nvdv4.09.4CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Nuclei
Windmill < 1.603.3 - Operator Authorization Bypass
nuclei·CVSS 8.8
CVE-2026-22683 [HIGH] Windmill < 1.603.3 - Operator Authorization Bypass
Windmill < 1.603.3 - Operator Authorization Bypass
Windmill versions 1.276.0 through 1.603.2 contain an authorization bypass vulnerability in the folder management API endpoints. The endpoints for creating, deleting, and managing folder ownership do not enforce role-based access control for operator-level users. In Windmill, operators are restricted users intended to only execute existing scripts, but due to missing server-side authorization checks, operators can create folders, manage folder permissions, and access owner management endpoints. This bypass serves as the prerequisite for exploiting CVE-2026-23696 (SQL injection via folder addowner) enabling full privilege escalation from operator to super admin with remote code execution.
Template:
id: CVE-2026-22683
info:
name: Windmill
Nuclei
Windmill < 1.603.3 - SQL Injection
nuclei·CVSS 9.9
CVE-2026-23696 [CRITICAL] Windmill < 1.603.3 - SQL Injection
Windmill < 1.603.3 - SQL Injection
Windmill versions 1.276.0 through 1.603.2 contain an authenticated SQL injection vulnerability in the folder owner management endpoint. The addowner API endpoint passes user-supplied input directly into a SQL query without sanitization, enabling JSONB path injection. An authenticated user with operator-level access can extract sensitive data including JWT secrets, password hashes, API tokens, and database credentials, leading to full privilege escalation and remote code execution.
Template:
id: CVE-2026-23696
info:
name: Windmill < 1.603.3 - SQL Injection
author: chocapikk,DhiyaneshDk
severity: critical
description: |
Windmill versions 1.276.0 through 1.603.2 contain an authenticated SQL injection vulnerability in the folder owner management endpoint.
https://apps.nextcloud.com/apps/flow/releaseshttps://chocapikk.com/posts/2026/windfall-nextcloud-flow-windmill-rce/https://github.com/Chocapikk/Windfallhttps://github.com/windmill-labs/windmill/commit/942fb629210ebb287f48467d1535ffde3a3eeafehttps://github.com/windmill-labs/windmill/releases/tag/v1.603.3https://www.vulncheck.com/advisories/windmill-file-ownership-handling-sqli-rcehttps://www.windmill.dev/
2026-04-07
Published