ProcessMaker EUVD-2026-95777

Exploitation requires an authenticated ProcessMaker session (any low-privilege user account suffices - PR:L) and access to the GET /api/1.0/tasks REST endpoint, which is a core default-enabled API in affected ProcessMaker builds prior to 2026.14.3. The specific trigger is supplying a malicious column name in the order_by request parameter, which reaches the unvalidated DB::raw() subquery in TaskControllerIndexMethods::applyColumnOrdering(). The principal limiting factors are: (1) valid credentials are mandatory, so purely anonymous exploitation is not possible; (2) the injection is blind/time-based, requiring many requests and increasing noise/time cost; and (3) extracted data is bounded by the privileges of the ProcessMaker database account. No non-default configuration or user interaction is needed.

This is a genuine but moderate-priority issue rather than an urgent one. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates a network-reachable, low-complexity attack requiring low-privilege authentication, with high confidentiality impact but no integrity or availability impact - consistent with a blind, time-based SQL injection used for data exfiltration. The description and the GitHub PR diff (pull/9041, commit 2622b7a) independently confirm the root cause: unvalidated concatenation of a user-controlled column name into a DB::raw() subquery in TaskControllerIndexMethods::applyColumnOrdering(), fixed by an allow-list of process_requests/token columns. No EPSS score, CISA KEV listing, POC, or SSVC decision data was supplied, so exploitation probability cannot be quantified; the absence of these signals is not evidence of safety but does argue against widespread automated exploitation at this time. The key limiting factor is that any valid authenticated account is required (PR:L), which restricts the attacker population to insiders or anyone who has obtained ProcessMaker credentials, and confines the blast radius to data reachable by the ProcessMaker DB account. Signals are internally consistent (CVSS confidentiality-only impact matches a read-oriented blind SQLi); no conflicts requiring vendor verification were identified.

An attacker holding any valid ProcessMaker account sends GET /api/1.0/tasks requests with a crafted order_by parameter that injects a boolean/time-based SQL condition into the process_requests ordering subquery. By observing response timing differences across many requests, they infer and exfiltrate database contents (other users' case data, credentials, or tokens) one bit at a time. No public exploit code was identified in the provided data, but the simple network-reachable vector (AV:N/AC:L) makes manual exploitation with standard tooling straightforward.