CVE-2026-26964

{"id": "CVE-2026-26964", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.2}]}, "published": "2026-02-20T00:16:16.330", "references": [{"url": "https://github.com/windmill-labs/windmill/commit/43218c62852490d0efafa8f94385bfe0e8f2ad82", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/windmill-labs/windmill/releases/tag/v1.635.0", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/windmill-labs/windmill/security/advisories/GHSA-f27g-j463-q85w", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Versions 1.634.6\n and below allow non-admin users to obtain Slack OAuth client secrets, which should only be accessible to workspace administrators. The GET /api/w/{workspace}/workspaces/get_settings endpoint returns the slack_oauth_client_secret to any authenticated workspace member, regardless of their admin status. It is expected behavior for non-admin users see a redacted version of workspace settings, as some of them are necessary for the frontend to behave correctly even for non-admins. However, the Slack configuration should not be visible to non-admins. This is a legacy issue where the setting was stored as a plain value instead of using $variable indirection, and it was never added to the redaction logic. This issue has been fixed in version 1.635.0."}, {"lang": "es", "value": "Windmill es una plataforma de desarrollo de c\u00f3digo abierto para c\u00f3digo interno: APIs, trabajos en segundo plano, flujos de trabajo e interfaces de usuario. Las versiones 1.634.6 y anteriores permiten a los usuarios no administradores obtener secretos de cliente de Slack OAuth, que solo deber\u00edan ser accesibles para los administradores del espacio de trabajo. El endpoint GET /api/w/{workspace}/workspaces/get_settings devuelve el slack_oauth_client_secret a cualquier miembro autenticado del espacio de trabajo, independientemente de su estado de administrador. Es un comportamiento esperado que los usuarios no administradores vean una versi\u00f3n redactada de la configuraci\u00f3n del espacio de trabajo, ya que algunos de ellos son necesarios para que el frontend se comporte correctamente incluso para los no administradores. Sin embargo, la configuraci\u00f3n de Slack no deber\u00eda ser visible para los no administradores. Este es un problema heredado donde la configuraci\u00f3n se almacenaba como un valor sin formato en lugar de usar la indirecci\u00f3n de $variable, y nunca se a\u00f1adi\u00f3 a la l\u00f3gica de redacci\u00f3n. Este problema ha sido solucionado en la versi\u00f3n 1.635.0."}], "lastModified": "2026-04-14T00:50:19.050", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:windmill:windmill:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DFD14609-DFAB-4B7A-98CD-B4537FF97C5B", "versionEndExcluding": "1.635.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}