CVE-2026-85388: Worklenz through 3.0.0 SQL Injection via the sort-field Query Parameter
Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affecting project and task management controllers, reporting and financial data endpoints, real-time socket.io handlers, and resource allocation and scheduling features. The vulnerability has been patched in version v2.1.7.
Other sources
Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract sensitive database content including password hashes from other tenants. This is an incomplete fix for CVE-2026-25947.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Worklenzto a version that resolves this vulnerability.Fixed in 2.1.7
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
An attacker needs an authenticated Worklenz account with permission to reach an endpoint that uses the affected pagination helper functions. No user interaction is required.
What data could be exposed?
The injection can be used to run arbitrary PostgreSQL expressions in ORDER BY clauses and extract database content through blind techniques. The reported impact includes sensitive data such as password hashes belonging to other tenants.
Is this related to an earlier vulnerability?
Yes. It is described as an incomplete fix for CVE-2026-25947, so environments that applied only that earlier fix may still be affected through the sort-field parameter.