CyberRota Analysis
AI-GeneratedWindmill Labs Windmill versions up to 1.783.0 have a missing authorization vulnerability that allows authenticated operators to access and manipulate job metrics across all workspaces, regardless of ownership. This flaw enables unauthorized monitoring of sensitive job execution data and the potential injection of misleading job progress information. Organizations using this software should prioritize remediation to protect against data integrity issues and unauthorized access to sensitive operational metrics.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write job progress and read job metrics for any job in the workspace regardless of ownership. The job_metrics handlers accept no authorization extractor, bypassing workspace-level access controls. An operator can monitor sensitive job execution data and inject misleading progress for jobs they do not own.