Vulnerability Description
Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract sensitive database content including password hashes from other tenants. This is an incomplete fix for CVE-2026-25947.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/Worklenz/worklenz
- https://github.com/Worklenz/worklenz/blob/v3.0.0/worklenz-backend/src/controller
- https://github.com/Worklenz/worklenz/blob/v3.0.0/worklenz-backend/src/controller
- https://github.com/Worklenz/worklenz/issues/395
- https://github.com/Worklenz/worklenz/security/advisories/GHSA-f2f8-2ppj-85pf
- https://www.vulncheck.com/advisories/worklenz-through-3.0.0-sql-injection-via-th
- https://github.com/Worklenz/worklenz/issues/395
FAQ
What is CVE-2026-85388?
CVE-2026-85388 is a vulnerability with a CVSS score of 8.1 (HIGH). Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY c...
How severe is CVE-2026-85388?
CVE-2026-85388 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-85388?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.