CVE-2026-85388 SQL Injection in Worklenz

Worklenz versions 3.0.0 and earlier contain a critical vulnerability in the pagination helper functions that fail to properly sanitize the 'sort-field' query parameter. This oversight allows authenticated users to inject arbitrary PostgreSQL expressions directly into ORDER BY clauses. The flaw serves as an incomplete fix for a previously identified vulnerability, CVE-2026-25947. Attackers can leverage this SQL injection (SQLi) vector to execute time-based or boolean-based blind injection attacks. By manipulating the database queries, unauthorized users can exfiltrate sensitive information, including password hashes from other tenants in a multi-tenant environment. Given the application's reliance on PostgreSQL, the impact is significant for organizations housing sensitive data within Worklenz instances. Defenders must prioritize upgrading to a version that addresses this improper input validation and review application logs for anomalous query parameter patterns.

Impact

Successful exploitation allows authenticated users to bypass data isolation and extract sensitive database contents. This impacts the confidentiality of all tenant data managed by the Worklenz instance, including credentials, which could lead to further unauthorized access or account takeover across the platform.

Recommendation

• Upgrade Worklenz to a version beyond 3.0.0 that contains the complete fix for CVE-2026-85388.
• Review web server access logs for anomalous characters or SQL keywords (e.g., CASE, WHEN, THEN, SLEEP, SELECT, UNION) within the 'sort-field' query parameter.
• Apply the principle of least privilege to the Worklenz database user account to restrict access to system tables or sensitive metadata.