WORKLENZ · CVE-2026-104060 · Package
NO FIX YET · SEE WHAT TO DO
Worklenz before 3.3.0 lets an authenticated user inject SQL through the projects and status parameters of its reporting members endpoints. An attacker can read arbitrary database contents, including user password hashes, across tenants using time-based blind techniques.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted or deployed Worklenz instances before 3.3.0 where users have accounts, since the attacker must be authenticated. Exposure is through the reporting members endpoints that build IN clauses from the projects and status parameters without parameterization. Instances already on 3.3.0 or later are not affected by this flaw.
Not affected if no-authenticated-users, version-3.3.0-or-later
Who cares self-hosted, sql, worklenz
3.3.0 are affected.POST /api/v1/reporting/members/all and GET /api/v1/reporting/members/export in your deployment.3.3.0 or later.Worklenz before 3.3.0 contains an SQL injection vulnerability in the reporting members endpoints that allows authenticated attackers to read arbitrary database contents by injecting SQL through the projects and status parameters. Attackers can send crafted values to POST /api/v1/reporting/members/all or GET /api/v1/reporting/members/export, which are interpolated unparameterized into IN clauses in getTeamMemberInsightData, and use time-based blind techniques to extract data across tenants, including user password hashes.
This page as .md ·
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.