The vulnerability is a missing authorization check in the job_metrics handlers of Windmill Labs windmill. Because the handlers do not enforce workspace‑level access controls, any authenticated operator can read the metrics for any job in the workspace and can also write misleading progress updates for jobs they do not own. This allows an attacker to exfiltrate sensitive job execution data and to inject false progress information, potentially masking real failures or fabricating successful completions. The weakness is classified as CWE‑306 (Missing Authorization).

Windmill Labs windmill, any release from the earliest version through 1.783.0 is affected. The problem was identified in the repository through commit history up to that version. While specific affected minor releases are not listed explicitly, all installations running 1.783.0 or earlier are vulnerable.

The CVSS score of 5.4 indicates a medium risk. Because the vulnerability requires an authenticated operator, the attack vector is primarily internal or requires compromised credentials. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. An adversary with legitimacy inside the workspace can surface sensitive metrics and corrupt the status of any job, which can lead to data leakage and confusion for stakeholders or automated systems that rely on job progress. As the threat is limited by authentication rather than remote code execution, the overall exploitability is moderate, but the potential operational impact is significant if the false progress leads to strategic decisions based on incorrect job status.