CVE-2026-85388 Worklenz through 3.0.0 SQL Injection via the sort-field Query Parameter
Authenticated attackers can inject SQL into the sort-field parameter to extract sensitive database content, including password hashes, from other tenants.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-85388?
CVE-2026-85388 is a high-severity SQL injection vulnerability in worklenz, published on 3 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract sensitive database content including password hashes from other tenants. This is an incomplete fix for CVE-2026-25947.
Weakness: CWE-89
Which versions are affected by CVE-2026-85388?
How do I fix CVE-2026-85388?
No fix has been published for CVE-2026-85388 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-85388 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-85388 exists.
Sources
Also known as GHSA-j38m-6g5x-xxgg.