A missing authorization vulnerability in Windmill allows authenticated Operator-level users to perform unauthorized actions, leading to full remote code execution.

The application fails to enforce proper authorization checks on workspace endpoints, specifically for the Operator role. This allows an authenticated Operator to create or modify scripts, flows, and applications, which can subsequently be executed to achieve remote code execution on the underlying deployment.

Successful exploitation of this flaw allows an attacker with low-level Operator access to escalate privileges to full system control. This poses a severe risk of unauthorized data access, system disruption, and potential compromise of the entire workflow automation environment. With a CVSS score of 8.8, this vulnerability represents a high-severity threat that could lead to complete administrative takeover of the Windmill deployment.

Immediate Action: Update all Windmill CE and EE instances to version 1.615.0 or later to ensure the missing authorization checks are correctly enforced.

Proactive Monitoring: Review audit logs for suspicious activity involving the creation or modification of scripts and workflows by users assigned the Operator role.

Compensating Controls: If immediate patching is not feasible, restrict the permissions of all users currently assigned the Operator role to the absolute minimum required for their tasks, or temporarily revoke their access.

Public Exploit Available: Yes, a Nuclei detection template exists as confirmed by the exploit maturity data.

Given the ability for a low-privileged user to achieve remote code execution, this vulnerability poses a significant risk to any organization utilizing Windmill for workflow automation. Administrators must prioritize updating to version 1.615.0 immediately to eliminate this authorization gap. Organizations should also conduct a thorough review of their workspace entity history to ensure no unauthorized scripts or flows were introduced during the period the system was vulnerable.