CloudMap 漏洞情报库

高危CVE-2026-226832026/07/28

Windmill < 1.603.3 - Operator Authorization Bypass

Windmill versions 1.276.0 through 1.603.2 contain an authorization bypass vulnerability in the folder management API endpoints. The endpoints for creating, deleting, and managing folder ownership do not enforce role-based access control for operator-level users. In Windmill, operators are restricted users intended to only execute existing scripts, but due to missing server-side authorization checks, operators can create folders, manage folder permissions, and access owner management endpoints. This bypass serves as the prerequisite for exploiting CVE-2026-23696 (SQL injection via folder addowner) enabling full privilege escalation from operator to super admin with remote code execution.

WindmillPoC 已收录

CVSS—

严重CVE-2026-236962026/07/28

Windmill < 1.603.3 - SQL Injection

Windmill versions 1.276.0 through 1.603.2 contain an authenticated SQL injection vulnerability in the folder owner management endpoint. The addowner API endpoint passes user-supplied input directly into a SQL query without sanitization, enabling JSONB path injection. An authenticated user with operator-level access can extract sensitive data including JWT secrets, password hashes, API tokens, and database credentials, leading to full privilege escalation and remote code execution.

WindmillPoC 已收录

CVSS—

严重CVE-2026-290592026/06/25

Windmill/Nextcloud Flow < 1.603.3 - Unauthenticated Path Traversal

Windmill < 1.603.3 contains a path traversal caused by unsanitized filename parameter in get_log_file endpoint, letting unauthenticated attackers read arbitrary files on the server, exploit requires no authentication.

WindmillPoC 已收录EXP 已收录

CVSS—

Windmill

关联漏洞

Windmill < 1.603.3 - Operator Authorization Bypass

Windmill < 1.603.3 - SQL Injection

Windmill/Nextcloud Flow < 1.603.3 - Unauthenticated Path Traversal