CVE-2026-85388

Worklenz through 3.0.0 does not properly validate the sort-field query parameter used by its pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses (CWE-89). Because the injection point returns no direct output, attackers use time-based or boolean-based blind SQL injection techniques to extract database content. Successful exploitation lets an authenticated user read sensitive data, including password hashes belonging to other tenants, which is a cross-tenant information exposure. Any Worklenz deployment running version 3.0.0 or earlier is affected, and this flaw is an incomplete fix for the earlier CVE-2026-25947, so systems patched for that issue may still be vulnerable. There is no public proof-of-concept, the issue is not in CISA KEV, and EPSS is 0.3% (20th percentile), indicating no known exploitation at this time.

What to do: Upgrade Worklenz to a release superseding 3.0.0 that contains the completed fix for both CVE-2026-85388 and the earlier CVE-2026-25947, since the prior patch was incomplete. As an interim mitigation, restrict or whitelist the sort-field parameter server-side so only known column names are accepted, and restrict accounts of untrusted users. Review PostgreSQL logs for anomalous delayed or repeatedly failing ORDER BY queries that would indicate blind injection probing.