CVE-2026-85389

MediumCVSS 6.5

Published: 03/09/2026(UTC)Updated: 14/09/2026(UTC)Translated: 04/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

Summary

Worklenz before version 3.0.0 fails to verify task ownership by organization when resolving task-scoped API endpoints, allowing authenticated users to access another tenant's task data. Attackers can query task endpoints with arbitrary task UUIDs to retrieve work logs, comments, attachments, and project insights belonging to other organizations.

Risk Assessment

Breach of multi-tenant isolation may lead to leakage of confidential project data and loss of customer trust.

Recommendation

Upgrade Worklenz to version 3.0.0 or later, which includes a fix for task ownership verification.

Other vulnerabilities in Worklenz

CVE-2026-85388High
Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract sensitive database content including password hashes from other tenants. This is an incomplete fix for CVE-2026-25947.

Original NVD description (English source)

Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API endpoints, allowing authenticated users to access another tenant's task data. Attackers can query task endpoints with arbitrary task UUIDs to retrieve work logs, comments, attachments, and project insights belonging to other organizations.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS