Search
Find a vulnerability
Search criteria
3 vulnerabilities found for worklenz by Worklenz
CVE-2026-85389 (GCVE-0-2026-85389)
Vulnerability from cvelistv5 – Published: 2026-09-03 18:54 – Updated: 2026-09-14 13:50
VLAI
EPSS
VEX
Title
Worklenz before 3.0.0 Authorization Bypass on Task-Scoped Endpoints
Summary
Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API endpoints, allowing authenticated users to access another tenant's task data. Attackers can query task endpoints with arbitrary task UUIDs to retrieve work logs, comments, attachments, and project insights belonging to other organizations.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 13:04 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/Worklenz/worklenz/issues/396 | issue-tracking |
| https://github.com/Worklenz/worklenz | product |
| https://github.com/Worklenz/worklenz/commit/f088a… | patch |
| https://github.com/Worklenz/worklenz/blob/v3.0.0/… | technical-description |
| https://github.com/Worklenz/worklenz/releases/tag… | release-notes |
| https://www.vulncheck.com/advisories/worklenz-bef… | third-party-advisory |
Impacted products
Date Public
2026-07-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85389",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T13:04:55.202786Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T13:50:52.023Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "worklenz",
"vendor": "Worklenz",
"versions": [
{
"lessThan": "3.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:worklenz:worklenz:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-07-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API endpoints, allowing authenticated users to access another tenant\u0027s task data. Attackers can query task endpoints with arbitrary task UUIDs to retrieve work logs, comments, attachments, and project insights belonging to other organizations."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T18:54:23.204Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #396",
"tags": [
"issue-tracking"
],
"url": "https://github.com/Worklenz/worklenz/issues/396"
},
{
"tags": [
"product"
],
"url": "https://github.com/Worklenz/worklenz"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Worklenz/worklenz/commit/f088ad0e36a23bb52857b46b3d4ce2533daeb65f"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Worklenz/worklenz/blob/v3.0.0/worklenz-backend/src/middlewares/verify-task-access.ts"
},
{
"name": "Worklenz v3.0.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/Worklenz/worklenz/releases/tag/v3.0.0"
},
{
"name": "VulnCheck Advisory: Worklenz before 3.0.0 Authorization Bypass on Task-Scoped Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/worklenz-before-3.0.0-authorization-bypass-on-task-scoped-endpoints"
}
],
"title": "Worklenz before 3.0.0 Authorization Bypass on Task-Scoped Endpoints",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-85389",
"datePublished": "2026-09-03T18:54:23.204Z",
"dateReserved": "2026-09-03T18:10:45.694Z",
"dateUpdated": "2026-09-14T13:50:52.023Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85388 (GCVE-0-2026-85388)
Vulnerability from cvelistv5 – Published: 2026-09-03 18:54 – Updated: 2026-09-03 19:12
VLAI
EPSS
VEX
Title
Worklenz through 3.0.0 SQL Injection via the sort-field Query Parameter
Summary
Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract sensitive database content including password hashes from other tenants. This is an incomplete fix for CVE-2026-25947.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-03 19:11 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/Worklenz/worklenz/issues/395 | issue-tracking |
| https://github.com/Worklenz/worklenz | product |
| https://github.com/Worklenz/worklenz/blob/v3.0.0/… | technical-description |
| https://github.com/Worklenz/worklenz/blob/v3.0.0/… | technical-description |
| https://github.com/Worklenz/worklenz/security/adv… | vendor-advisory |
| https://www.vulncheck.com/advisories/worklenz-thr… | third-party-advisory |
Impacted products
Date Public
2026-07-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85388",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-03T19:11:51.241635Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T19:12:07.885Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Worklenz/worklenz/issues/395"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "worklenz",
"vendor": "Worklenz",
"versions": [
{
"lessThanOrEqual": "3.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:worklenz:worklenz:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-07-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract sensitive database content including password hashes from other tenants. This is an incomplete fix for CVE-2026-25947."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T18:54:22.561Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #395",
"tags": [
"issue-tracking"
],
"url": "https://github.com/Worklenz/worklenz/issues/395"
},
{
"tags": [
"product"
],
"url": "https://github.com/Worklenz/worklenz"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Worklenz/worklenz/blob/v3.0.0/worklenz-backend/src/controllers/worklenz-controller-base.ts"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Worklenz/worklenz/blob/v3.0.0/worklenz-backend/src/controllers/job-titles-controller.ts"
},
{
"name": "GitHub Security Advisory (GHSA-f2f8-2ppj-85pf)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/Worklenz/worklenz/security/advisories/GHSA-f2f8-2ppj-85pf"
},
{
"name": "VulnCheck Advisory: Worklenz through 3.0.0 SQL Injection via the sort-field Query Parameter",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/worklenz-through-3.0.0-sql-injection-via-the-sort-field-query-parameter"
}
],
"title": "Worklenz through 3.0.0 SQL Injection via the sort-field Query Parameter",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-85388",
"datePublished": "2026-09-03T18:54:22.561Z",
"dateReserved": "2026-09-03T18:10:45.350Z",
"dateUpdated": "2026-09-03T19:12:07.885Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-25947 (GCVE-0-2026-25947)
Vulnerability from cvelistv5 – Published: 2026-02-10 17:32 – Updated: 2026-02-10 19:26
VLAI
EPSS
VEX
Title
Worklenz Boolean-Based Blind SQL Injection via Improper ORDER BY Clause Input Validation
Summary
Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affecting project and task management controllers, reporting and financial data endpoints, real-time socket.io handlers, and resource allocation and scheduling features. The vulnerability has been patched in version v2.1.7.
Severity
8.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-10 19:26 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/Worklenz/worklenz/security/adv… | x_refsource_CONFIRM |
| https://github.com/Worklenz/worklenz/commit/76e5c… | x_refsource_MISC |
| https://github.com/Worklenz/worklenz/releases/tag… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-25947",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-10T19:26:10.012909Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-10T19:26:19.859Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "worklenz",
"vendor": "Worklenz",
"versions": [
{
"status": "affected",
"version": "\u003c 2.1.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affecting project and task management controllers, reporting and financial data endpoints, real-time socket.io handlers, and resource allocation and scheduling features. The vulnerability has been patched in version v2.1.7."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-10T17:32:56.224Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Worklenz/worklenz/security/advisories/GHSA-f2f8-2ppj-85pf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Worklenz/worklenz/security/advisories/GHSA-f2f8-2ppj-85pf"
},
{
"name": "https://github.com/Worklenz/worklenz/commit/76e5cb0f5dd566fb65586cd3db30ee951c92a32b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Worklenz/worklenz/commit/76e5cb0f5dd566fb65586cd3db30ee951c92a32b"
},
{
"name": "https://github.com/Worklenz/worklenz/releases/tag/v2.1.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Worklenz/worklenz/releases/tag/v2.1.7"
}
],
"source": {
"advisory": "GHSA-f2f8-2ppj-85pf",
"discovery": "UNKNOWN"
},
"title": "Worklenz Boolean-Based Blind SQL Injection via Improper ORDER BY Clause Input Validation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-25947",
"datePublished": "2026-02-10T17:32:56.224Z",
"dateReserved": "2026-02-09T17:13:54.064Z",
"dateUpdated": "2026-02-10T19:26:19.859Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}