CVE-2026-72539

Name of the Vulnerable Software and Affected Versions Windmill Labs Windmill versions prior to 1.783.1

Description An information disclosure issue allows authenticated workspace members to read legacy ownerless draft scripts containing plaintext resource credentials. This occurs because drafts with a null owner email bypass Access Control List (ACL) enforcement—a security mechanism that defines which users have access to specific resources—and are returned to any member querying the drafts endpoint. Consequently, sensitive credentials stored in these drafts are exposed across ACL boundaries.

Recommendations Update Windmill Labs Windmill to version 1.783.1 or later.