EUVD-2026-70666
GHSA-3hvp-rq7g-qf5w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable IDOR requiring only authenticated access (PR:L); confidentiality-only impact since attacker reads but cannot modify cross-tenant task data.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API endpoints, allowing authenticated users to access another tenant's task data. Attackers can query task endpoints with arbitrary task UUIDs to retrieve work logs, comments, attachments, and project insights belonging to other organizations.
AnalysisAI
Cross-tenant IDOR in Worklenz before 3.0.0 allows any authenticated user to read task data owned by other organizations on the same instance. Task-scoped API endpoints resolved arbitrary task UUIDs supplied by the caller without verifying that the requesting user's organization owned the referenced task, exposing work logs, comments, attachments, and project insights across tenant boundaries. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Worklenz account (any authenticated role) on the same multi-tenant deployment as the victim organization. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.1 accurately captures a network-exploitable, low-complexity IDOR that requires authentication (PR:L) and carries high confidentiality impact with no integrity or availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Worklenz v3.0.0 or later, which introduces the `verify-task-access.ts` middleware to enforce tenant-scoped ownership validation on all task-scoped API endpoints. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Worklenz deployments in your environment and confirm whether they are running versions prior to 3.0.0 on shared multi-tenant infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Worklenz is a project management tool. [CVSS 8.8 HIGH]
Worklenz version 2.1.5 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Project Updates feature. An att
Blind SQL injection in Worklenz through version 3.0.0 exposes cross-tenant password hashes and other sensitive database
Share
External POC / Exploit Code
Leaving vuln.today