CVE-2026-23696

Windmill < 1.603.3 File Ownership Handling SQLi RCE

State: Published
Severity: 9.4 Critical
Published: Apr 7, 2026
Updated: Jul 14, 2026
Reserved: Jan 14, 2026

Description

Windmill CE and EE versions 1.276.0 through 1.603.2 contain an SQL injection vulnerability in the folder ownership management functionality that allows authenticated attackers to inject SQL through the owner parameter. An attacker can use the injection to read sensitive data such as the JWT signing secret and administrative user identifiers, forge an administrative token, and then execute arbitrary code via the workflow execution endpoints.

Scores

CVSS	Score	Vector	Source
4.0	9.4 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H	VulnCheck
3.1	9.9 Critical	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	VulnCheck

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
Windmill CE (Community Edition)Windmill Labs	1.276.0 through 1.603.2Affected 1.603.3Not affected
Windmill EE (Enterprise Edition)Windmill Labs	1.276.0 through 1.603.2Affected 1.603.3Not affected

References

https://chocapikk.com/posts/2026/windfall-nextcloud-flow-windmill-rce/technical-descriptionexploit
https://github.com/Chocapikk/Windfallexploit
https://github.com/windmill-labs/windmill/releases/tag/v1.603.3release-notes
https://github.com/windmill-labs/windmill/commit/942fb629210ebb287f48467d1535ffde3a3eeafepatch
https://www.windmill.dev/product
https://apps.nextcloud.com/apps/flow/releasesrelease-notes
https://www.vulncheck.com/advisories/windmill-file-ownership-handling-sqli-rcethird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.