CVE-2026-104060: Worklenz < 3.3.0 SQL Injection via Reporting Members Endpoint
Worklenz before 3.3.0 contains an SQL injection vulnerability in the reporting members endpoints that allows authenticated attackers to read arbitrary database contents by injecting SQL through the projects and status parameters. Attackers can send crafted values to POST /api/v1/reporting/members/all or GET /api/v1/reporting/members/export, which are interpolated unparameterized into IN clauses in getTeamMemberInsightData, and use time-based blind techniques to extract data across tenants, including user password hashes.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Worklenz versions before 3.3.0 are affected. The vulnerable functionality is exposed through the reporting members endpoints at POST /api/v1/reporting/members/all and GET /api/v1/reporting/members/export.
What level of access does an attacker need?
An attacker must be authenticated and able to submit requests to the reporting members endpoints. No user interaction is required, and exploitation can be performed remotely over the network.
What data could be exposed?
An attacker can use SQL injection in the projects and status parameters to read arbitrary database contents. The issue can be exploited with time-based blind techniques and may expose cross-tenant data, including user password hashes.
What is the remediation?
Upgrade Worklenz to version 3.3.0 or later. The referenced 3.3.0 release, pull request 624, and commit f58c7dbcc68fcda31a5cd4ce68d02af7ea8c37e1 contain the relevant fix.