Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to… (CVE-2026-85388)

The vulnerability in Worklenz up to version 3.0.0 arises from improper validation of the sort-field query parameter in pagination helper functions. Authenticated attackers can inject arbitrary PostgreSQL expressions into ORDER BY clauses, facilitating blind SQL injection attacks (time-based and boolean-based). This can be exploited to extract sensitive data such as password hashes belonging to other tenants. The issue represents an incomplete remediation of CVE-2026-25947, indicating residual risk despite prior fixes.

Successful exploitation allows authenticated users to perform blind SQL injection attacks, potentially leading to unauthorized disclosure of sensitive database information, including password hashes of other tenants. This compromises confidentiality and could facilitate further attacks against affected systems or users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is currently referenced, users should monitor vendor communications for updates. Until a fix is available, restrict access to authenticated users and consider additional input validation or query parameter filtering as a temporary mitigation.