Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

windmill-api

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.1crates.ioPublished

    Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search

    CVE-2026-54136 · GHSA-2ppx-66jv-wpw5

    Affected
    • crates.io windmill-api <= 1.714.1
    Fixed in
    1.715.0· Vendor fix available
    Issue
    A resource-scoped API token can read script contents outside its allowed path scope via GET /api/w/{workspace}/scripts/listsearch. This appears to be a remaining variant of the scoped-token authorization class previously addressed for other endpoints. The route-level scope middleware validates the token domain/action, but does not enforce the resource/path segment of a scope. scripts/listsearch then returns script path and content for scripts in the workspace without applying per-row path filtering against the token scopes. Affected endpoint GET /api/w/{workspace}/scripts/listsearch Affected versions Confirmed in the current public repository code and believed to affect the latest published release at the time of review: <= 1.714.1 Patched version: unknown. Details Windmill supports scoped API tokens with scopes in the format: {domain}:{action}[:{resource}] The parser supports resource-scoped values such as: scripts:read:f/allowed/ and the codebase contains helpers for…

    Recommended action: Upgrade to 1.715.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →