CVE-2026-85389: Worklenz before 3.0.0 Authorization Bypass on Task-Scoped Endpoints
Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API endpoints, allowing authenticated users to access another tenant's task data. Attackers can query task endpoints with arbitrary task UUIDs to retrieve work logs, comments, attachments, and project insights belonging to other organizations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Worklenzto a version that resolves this vulnerability.Fixed in 3.0.0 - Compensating control
Ensure task-scoped API endpoint authorization enforces task ownership by organization (reject requests where the authenticated user’s organization does not match the task’s organization) to prevent cross-tenant access to work logs, comments, attachments, and project insights.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Worklenz user may be able to exploit it. The attacker needs a task UUID belonging to another organization and can use it against task-scoped API endpoints.
What data may be exposed?
Affected endpoints can disclose another tenant's work logs, comments, attachments, and project insights associated with the targeted task.
Which versions are affected?
Worklenz versions before 3.0.0 are affected. Version 3.0.0 is the stated fixed-version boundary.
How can I determine whether exploitation may have occurred?
Review task-scoped API access for requests using task UUIDs that belong to organizations other than the authenticated user's organization. Look specifically for access to work logs, comments, attachments, or project-insight data across tenant boundaries.