https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-28T09:05:20.329291+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-54136 fkie_cve-2026-54136 2026-09-28T09:05:21.746376+00:00

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to 1.715.0, a resource-scoped API token could read script contents outside its allowed path scope through GET /api/w/{workspace}/scripts/list_search. The route-level scope middleware validated the token domain and action but did not enforce the resource/path segment, and the list_search_scripts handler had no additional check_scopes call or per-row filtering before returning script path and content fields. A token such as scripts:read:f/allowed/* could therefore receive source code for unrelated paths in the same workspace, potentially disclosing internal automation logic, integration details, business logic, inline configuration, or hardcoded secrets and credentials. Exploitation required possession of a valid scoped API token for the workspace but did not require administrator privileges. This issue is fixed in version 1.715.0.

 https://vulnerability.circl.lu/vuln/ghsa-2ppx-66jv-wpw5 GHSA-2ppx-66jv-wpw5 — Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search 2026-09-28T09:05:21.746482+00:00

Affected: crates.io: windmill-api

### Summary

A resource-scoped API token can read script contents outside its allowed path scope via `GET /api/w/{workspace}/scripts/list_search`.

This appears to be a remaining variant of the scoped-token authorization class previously addressed for other endpoints. The route-level scope middleware validates the token domain/action, but does not enforce the resource/path segment of a scope. `scripts/list_search` then returns script `path` and `content` for scripts in the workspace without applying per-row path filtering against the token scopes.

### Affected endpoint

`GET /api/w/{workspace}/scripts/list_search`

### Affected versions

Confirmed in the current public repository code and believed to affect the latest published release at the time of review:

`<= 1.714.1`

Patched version: unknown.

### Details

Windmill supports scoped API tokens with scopes in the format:

`{domain}:{action}[:{resource}]`

The parser supports resource-scoped values such as:

`scripts:read:f/allowed/*`

and the codebase contains helpers for resource matching, including wildcard matching.

However, the route-level scope check used for requests with scoped API tokens only validates the route domain and action. It does not compare the token's resource/path restriction against the requested route or against the rows returned by list endpoints.

For `scripts/list_search`, the handler returns `path` and `content` for scripts in the workspace:

`SELECT path, content from script WHERE workspace_id…