CVE-2026-54136

Name of the Vulnerable Software and Affected Versions Windmill versions prior to 1.715.0

Description A resource-scoped API token can read script contents outside its allowed path scope. This occurs because the route-level scope middleware validates the token domain and action but fails to enforce the resource or path segment. Specifically, the handler for the 'GET /api/w/{workspace}/scripts/list search' endpoint does not perform additional scope checks or per-row filtering before returning script path and content fields. An attacker possessing a valid scoped API token for a workspace, such as one with the scope scripts:read:f/allowed/*, could access source code for unrelated paths within the same workspace. This could lead to the disclosure of internal automation logic, integration details, business logic, inline configuration, or hardcoded secrets and credentials. This issue does not require administrator privileges.

Recommendations Update to version 1.715.0. As a temporary workaround, restrict the use of resource-scoped API tokens for the 'GET /api/w/{workspace}/scripts/list search' endpoint until the update is applied.