Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: Worklenz Clear all filters
TI-2026-58597 CVE-2026-85389 · GHSA-3hvp-rq7g-qf5w

Worklenz before 3.0.0 Authorization Bypass on Task-Scoped Endpoints

Priority LOW 32

Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API endpoints, allowing authenticated users to access another tenant's task data.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00454 Published 2026-09-03 Fixed in 3.0.0 CWE-639
TI-2026-58596 CVE-2026-85388 · GHSA-j38m-6g5x-xxgg

Worklenz through 3.0.0 SQL Injection via the sort-field Query Parameter

Priority HIGH 72

Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00477 Published 2026-09-03 No fix listed CWE-89