Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API endpoints, allowing authenticated users to… (CVE-2026-85389)

The vulnerability identified as CVE-2026-85389 affects Worklenz before version 3.0.0. It arises from improper verification of task ownership by organization in task-scoped API endpoints. Authenticated users can exploit this to retrieve sensitive task-related data from other tenants by supplying arbitrary task UUIDs, bypassing intended access controls. This issue is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS v3.1 base score is 6.5, indicating a high severity with network attack vector, low attack complexity, and requiring low privileges with no user interaction. Confidentiality impact is high, while integrity and availability impacts are none.

An attacker with valid authentication can access sensitive task data from other organizations, including work logs, comments, attachments, and project insights. This results in a high confidentiality breach but does not affect data integrity or availability. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, organizations should monitor vendor communications for updates. Until a fix is available, restrict access to authenticated users and consider additional access control reviews to limit exposure.