CVE-2026-85388: Worklenz through 3.0.0 SQL Injection via the sort-field Query Parameter
Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract sensitive database content including password hashes from other tenants. This is an incomplete fix for CVE-2026-25947.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Worklenzto a version that resolves this vulnerability.Fixed in 3.0.0 - Compensating control
Restrict access to the Worklenz pagination/sort functionality (e.g., limit who can reach endpoints that use the sort-field query parameter) so authenticated users cannot exploit ORDER BY expression injection to extract cross-tenant data.
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
An attacker needs an authenticated Worklenz account with permission to reach an endpoint that uses the affected pagination helper functions. No user interaction is required.
What data could be exposed?
The injection can be used to run arbitrary PostgreSQL expressions in ORDER BY clauses and extract database content through blind techniques. The reported impact includes sensitive data such as password hashes belonging to other tenants.
Is this related to an earlier vulnerability?
Yes. It is described as an incomplete fix for CVE-2026-25947, so environments that applied only that earlier fix may still be affected through the sort-field parameter.