Read the docs
TI-2026-70027 Aliases CVE-2026-107803

SQL injection in ProcessMaker tasks endpoint via order_by parameter

Priority LOW 28CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

ProcessMaker versions before 2026.14.3 are affected. The GET /api/1.0/tasks endpoint concatenates a user-controlled column name from the order_by parameter into a DB::raw() SQL subquery without validation or parameter binding (CWE-89). Any authenticated user can run blind, time-based queries to extract data that the ProcessMaker database account can read.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the `GET /api/1.0/tasks` endpoint in ProcessMaker is vulnerable to SQL injection through the order_by parameter because `ProcessMaker\Traits\TaskControllerIndexMethods::applyColumnOrdering()` concatenates a user-controlled process_requests column name into a DB::raw() SQL subquery without validation or parameter binding. Any authenticated user can use blind, time-based queries to infer and extract data accessible to the ProcessMaker database account. This issue is fixed in version 2026.14.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00249 16th percentileScored 2026-11-07
Fix Fixed processmaker (ProcessMaker): 2026.14.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ProcessMakerprocessmakerbefore 2026.14.32026.14.3Patch availableCNA
  • processmaker VendorProcessMaker Affected before 2026.14.3 Fixed in 2026.14.3 Patch available CNA

Remediation

Upgrade ProcessMaker to version 2026.14.3, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA processmaker (ProcessMaker) Fixed in 2026.14.3

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-107803

References

Other 4

  • TI-2013-06178 ProcessMaker Open Source < 2.5.2 neoclassic Skin PHP Code Execution CVSS 4.0HIGH 8.7
  • TI-2025-24257 ProcessMaker < 3.5.4 Authenticated Plugin Upload RCE CVSS 4.0HIGH 8.6
  • TI-2021-22591 ProcessMaker 3.5.4 Local File Inclusion via Path Traversal CVSS 4.0MEDIUM 6.9
  • TI-2022-18153 ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user… CVSS 3.1HIGH 8.8
  • TI-2016-07407 Deserialization of untrusted data in ProcessMaker Enterprise CVSS 3.1HIGH 8.8
  • TI-2020-10605 SQL injection in ProcessMaker CVSS 3.1HIGH 8.8
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences