Windmill EE (Enterprise Edition) vulnerabilities

2 known vulnerabilities in Windmill EE (Enterprise Edition) from Windmill Labs. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.9 Critical severity

  Windmill CE (Community Edition): Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-23696Apr 7, 2026Windmill LabsEPSS 13.6%

  Windmill CE and EE versions 1.276.0 through 1.603.2 contain an SQL injection vulnerability in the folder ownership management functionality that allows authenticated attackers to inject SQL through the owner parameter. An attacker can use the injection to read

• 8.8 High severity

  Windmill CE (Community Edition): Missing Authorization

  CVE-2026-22683Apr 7, 2026Windmill LabsEPSS 2.61%

  Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as