Vulnerability · Published Sep 3, 2026 · Assigned by VulnCheck

CVE-2026-85388Worklenz through 3.0.0 SQL Injection via the sort-field Query Parameter

High 8.1

In plain English

A high-severity SQL injection in worklenz from Worklenz. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.5%top 58.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract sensitive database content including password hashes from other tenants. This is an incomplete fix for CVE-2026-25947.

Affected products (as reported)

Vendor	Product	Versions
Worklenz	worklenz	0 – through 3.0.0

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

GitHub Issue #395 issue-tracking
https://github.com/Worklenz/worklenz product
https://github.com/Worklenz/worklenz/blob/v3.0.0/worklenz-backend/src/controllers/worklenz-controller-base.ts technical-description
https://github.com/Worklenz/worklenz/blob/v3.0.0/worklenz-backend/src/controllers/job-titles-controller.ts technical-description
GitHub Security Advisory (GHSA-f2f8-2ppj-85pf) vendor-advisory
VulnCheck Advisory: Worklenz through 3.0.0 SQL Injection via the sort-field Query Parameter third-party-advisory