TI-2026-58597 Aliases CVE-2026-85389 GHSA-3hvp-rq7g-qf5w

Worklenz before 3.0.0 Authorization Bypass on Task-Scoped Endpoints

LOW 32CWE-639Published 2026-09-03 · Updated 2026-09-14

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API endpoints, allowing authenticated users to access another tenant's task data. Attackers can query task endpoints with arbitrary task UUIDs to retrieve work logs, comments, attachments, and project insights belonging to other organizations.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00454 39th percentileScored 2026-11-07

Fix Fixed worklenz (Worklenz): 3.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Worklenz	worklenz	before 3.0.0	3.0.0	Patch available	CNA

worklenz VendorWorklenz Affected before 3.0.0 Fixed in 3.0.0 Patch available CNA

Remediation

Fix · CNA worklenz (Worklenz) Fixed in 3.0.0

Timeline

2026-10-02 Threatist record created from CVE-2026-85389
2026-10-03 Alias added: GHSA-3hvp-rq7g-qf5w

References

Patch 1

https://github.com/Worklenz/worklenz/commit/f088ad0e36a23bb52857b46b3d4ce2533daeb65f

Other 4

TI-2026-20974 Worklenz Boolean-Based Blind SQL Injection via Improper ORDER BY Clause Input Validation CVSS 3.1HIGH 8.8
TI-2026-58596 Worklenz through 3.0.0 SQL Injection via the sort-field Query Parameter CVSS 4.0HIGH 8.6
TI-2025-43109 Worklenz version 2.1.5 contains a Stored Cross-Site Scripting (XSS) vulnerability in the… CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences