CVE-2026-85388
Received Received - Intake

Authentication Bypass via SQL Injection in Worklenz

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulnCheck

Description
Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract sensitive database content including password hashes from other tenants. This is an incomplete fix for CVE-2026-25947.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-04
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85388
EUVD
EUVD-2026-70665

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
worklenz worklenz to 3.0.0 (inc)
worklenz worklenz to 2.1.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Worklenz through version 3.0.0 has a flaw where it does not properly validate the sort-field query parameter in pagination functions. This allows authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses, enabling SQL injection attacks.

Detection Guidance

To detect this vulnerability, inspect HTTP requests for the sort-field parameter in Worklenz pagination endpoints. Look for PostgreSQL expressions like ORDER BY (SELECT ...) or time-based delays (e.g., pg_sleep(5)). Use tools like sqlmap to test for blind SQL injection. Monitor database logs for unusual queries or errors.

Impact Analysis

An attacker could exploit this to extract sensitive data like password hashes from other tenants in the system. They can use time-based or boolean-based blind SQL injection techniques to bypass authentication and access unauthorized information.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating privacy and security requirements under GDPR and HIPAA. It may result in data breaches, non-compliance penalties, and loss of trust due to exposure of personal or health information.

Mitigation Strategies

Immediately update Worklenz to the latest version. Implement strict input validation for the sort-field parameter, rejecting any non-alphanumeric values. Use parameterized queries to prevent SQL injection. Restrict database user permissions to limit data exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85388. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart