CVE-2026-85389

Worklenz before 3.0.0 does not verify that a requested task belongs to the caller's organization when resolving task-scoped API endpoints, a broken object-level authorization flaw (CWE-639). An authenticated user can trigger it simply by calling task endpoints with arbitrary task UUIDs; the server returns the data without checking tenant ownership. The attacker gains read access to other tenants' work logs, comments, attachments, and project insights — a confidentiality-only issue (CVSS 4.0 7.1 with VC:H, VI:N, VA:N), with no modification or disruption of other tenants' data. Any Worklenz deployment running a version prior to 3.0.0 is affected, with multi-organization installations at greatest risk since any valid login can enumerate other tenants' tasks. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at 0.3%, so no exploitation is currently known.

What to do: Upgrade Worklenz to 3.0.0 or later, which adds organization-ownership checks on task-scoped endpoints. Until patched, restrict which authenticated accounts can call task API endpoints and review logs for task queries referencing UUIDs outside the caller's organization, since successful abuse requires valid credentials. Because exposure is read-only, prioritize patching multi-tenant installations where cross-organization confidentiality matters most.