Worklenz
Monthly
Cross-tenant IDOR in Worklenz before 3.0.0 allows any authenticated user to read task data owned by other organizations on the same instance. Task-scoped API endpoints resolved arbitrary task UUIDs supplied by the caller without verifying that the requesting user's organization owned the referenced task, exposing work logs, comments, attachments, and project insights across tenant boundaries. No public exploit is identified at time of analysis, but the attack requires only valid credentials and basic HTTP tooling. Vendor-released patch: v3.0.0.
Blind SQL injection in Worklenz through version 3.0.0 exposes cross-tenant password hashes and other sensitive database content to any authenticated user by injecting arbitrary PostgreSQL expressions into ORDER BY clauses via the sort-field query parameter in pagination helper functions. This is explicitly an incomplete remediation of the prior CVE-2026-25947, indicating the original fix was insufficient and the root-cause injection sink remains open. No confirmed active exploitation is present in CISA KEV, but a public GitHub security advisory (GHSA-f2f8-2ppj-85pf) provides sufficient technical disclosure to guide reproduction.
Worklenz is a project management tool. [CVSS 8.8 HIGH]
Worklenz version 2.1.5 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Project Updates feature. An attacker can submit a malicious payload in the Updates text field which is then rendered in the reporting view without proper sanitization. [CVSS 5.4 MEDIUM]
Cross-tenant IDOR in Worklenz before 3.0.0 allows any authenticated user to read task data owned by other organizations on the same instance. Task-scoped API endpoints resolved arbitrary task UUIDs supplied by the caller without verifying that the requesting user's organization owned the referenced task, exposing work logs, comments, attachments, and project insights across tenant boundaries. No public exploit is identified at time of analysis, but the attack requires only valid credentials and basic HTTP tooling. Vendor-released patch: v3.0.0.
Blind SQL injection in Worklenz through version 3.0.0 exposes cross-tenant password hashes and other sensitive database content to any authenticated user by injecting arbitrary PostgreSQL expressions into ORDER BY clauses via the sort-field query parameter in pagination helper functions. This is explicitly an incomplete remediation of the prior CVE-2026-25947, indicating the original fix was insufficient and the root-cause injection sink remains open. No confirmed active exploitation is present in CISA KEV, but a public GitHub security advisory (GHSA-f2f8-2ppj-85pf) provides sufficient technical disclosure to guide reproduction.
Worklenz is a project management tool. [CVSS 8.8 HIGH]
Worklenz version 2.1.5 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Project Updates feature. An attacker can submit a malicious payload in the Updates text field which is then rendered in the reporting view without proper sanitization. [CVSS 5.4 MEDIUM]