{"id":"CVE-2026-104060","kind":"vulnerability","aliases":["CVE-2026-104060"],"related":[],"title":"Worklenz: SQL injection in reporting endpoints exposes database contents","description":"Worklenz before 3.3.0 contains an SQL injection vulnerability in the reporting members endpoints that allows authenticated attackers to read arbitrary database contents by injecting SQL through the projects and status parameters. Attackers can send crafted values to POST /api/v1/reporting/members/all or GET /api/v1/reporting/members/export, which are interpolated unparameterized into IN clauses in getTeamMemberInsightData, and use time-based blind techniques to extract data across tenants, including user password hashes.","summary":"Worklenz before 3.3.0 lets an authenticated user inject SQL through the projects and status parameters of its reporting members endpoints. An attacker can read arbitrary database contents, including user password hashes, across tenants using time-based blind techniques.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Worklenz","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["package","self-hosted","sql","worklenz"],"not_affected_if":["no-authenticated-users","version-3.3.0-or-later"],"how_to_check":"- Check the Worklenz version you run; the sources say versions before `3.3.0` are affected.\n- Look for the endpoints `POST /api/v1/reporting/members/all` and `GET /api/v1/reporting/members/export` in your deployment.","fix":"- Worklenz: upgrade to `3.3.0` or later.","status":"open","published_at":"2026-11-10T20:17:23+00:00","first_seen_at":"2026-11-10T20:46:01+00:00","triaged_at":"2026-11-10T20:47:54+00:00","updated_at":"2026-11-10T20:47:54+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-10T20:47:54Z","model":"claude-haiku-5-5","output":{"fix":"- Worklenz: upgrade to `3.3.0` or later.","reach":"network","title":"Worklenz: SQL injection in reporting endpoints exposes database contents","impact":"high","summary":"Worklenz before 3.3.0 lets an authenticated user inject SQL through the projects and status parameters of its reporting members endpoints. An attacker can read arbitrary database contents, including user password hashes, across tenants using time-based blind techniques.","audience":"businesses","category":"package","nicknames":[],"who_cares":["worklenz","self-hosted","sql"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads all database contents, including password hashes","analyst_note":"Confirm the affected version range and whether the vulnerable endpoints are reachable by default, using the Worklenz release notes and patch linked in the sources.","how_to_check":"- Check the Worklenz version you run; the sources say versions before `3.3.0` are affected.\n- Look for the endpoints `POST /api/v1/reporting/members/all` and `GET /api/v1/reporting/members/export` in your deployment.","plain_action":"","product_name":"Worklenz","needs_analyst":true,"not_affected_if":["version-3.3.0-or-later","no-authenticated-users"],"who_is_affected":"Self-hosted or deployed Worklenz instances before 3.3.0 where users have accounts, since the attacker must be authenticated. Exposure is through the reporting members endpoints that build IN clauses from the projects and status parameters without parameterization. Instances already on 3.3.0 or later are not affected by this flaw.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000777,"input_tokens":4675,"output_tokens":620,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-104060':12A,15A '-2026':11A,14A '/api/v1/reporting/members/all':100C '/api/v1/reporting/members/export':103C '3.3.0':25B,64C 'across':54B,123C 'allow':76C 'arbitrari':47B,81C 'attack':44B,78C,93C 'authent':28B,77C 'base':59B,117C 'blind':60B,118C 'claus':110C 'contain':65C 'content':9A,49B,83C 'craft':96C 'cve':10A,13A 'data':122C 'databas':8A,48B,82C 'endpoint':6A,42B,74C 'expos':7A 'extract':121C 'get':102C 'getteammemberinsightdata':112C 'hash':53B,128C 'host':20B 'includ':50B,125C 'inject':3A,30B,68C,85C 'interpol':106C 'let':26B 'member':41B,73C 'packag':17B 'paramet':37B,92C 'password':52B,127C 'post':99C 'project':34B,89C 'read':46B,80C 'report':5A,40B,72C 'self':19B 'self-host':18B 'send':95C 'sql':2A,21B,31B,67C,86C 'status':36B,91C 'techniqu':61B,119C 'tenant':55B,124C 'time':58B,116C 'time-bas':57B,115C 'unparameter':107C 'use':56B,114C 'user':29B,51B,126C 'valu':97C 'vulner':69C 'worklenz':1A,16A,22B,23B,62C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or deployed Worklenz instances before 3.3.0 where users have accounts, since the attacker must be authenticated. Exposure is through the reporting members endpoints that build IN clauses from the projects and status parameters without parameterization. Instances already on 3.3.0 or later are not affected by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["worklenz"],"ptokens":["worklenz"],"labels":["high","package","selfhosted","sql","vendor","worklenz"],"campaign_type":null,"search_a":"'-104060':12A,15A '-2026':11A,14A 'content':9A 'cve':10A,13A 'databas':8A 'endpoint':6A 'expos':7A 'inject':3A 'report':5A 'sql':2A 'worklenz':1A,16A","search_b":"'3.3.0':25B 'across':54B 'arbitrari':47B 'attack':44B 'authent':28B 'base':59B 'blind':60B 'content':49B 'databas':48B 'endpoint':42B 'hash':53B 'host':20B 'includ':50B 'inject':30B 'let':26B 'member':41B 'packag':17B 'paramet':37B 'password':52B 'project':34B 'read':46B 'report':40B 'self':19B 'self-host':18B 'sql':21B,31B 'status':36B 'techniqu':61B 'tenant':55B 'time':58B 'time-bas':57B 'use':56B 'user':29B,51B 'worklenz':22B,23B","search_c":"'/api/v1/reporting/members/all':100C '/api/v1/reporting/members/export':103C '3.3.0':64C 'across':123C 'allow':76C 'arbitrari':81C 'attack':78C,93C 'authent':77C 'base':117C 'blind':118C 'claus':110C 'contain':65C 'content':83C 'craft':96C 'data':122C 'databas':82C 'endpoint':74C 'extract':121C 'get':102C 'getteammemberinsightdata':112C 'hash':128C 'includ':125C 'inject':68C,85C 'interpol':106C 'member':73C 'paramet':92C 'password':127C 'post':99C 'project':89C 'read':80C 'report':72C 'send':95C 'sql':67C,86C 'status':91C 'techniqu':119C 'tenant':124C 'time':116C 'time-bas':115C 'unparameter':107C 'use':114C 'user':126C 'valu':97C 'vulner':69C 'worklenz':62C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104060","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104060","severity":null,"published_at":"2026-11-10T20:17:23+00:00","modified_at":"2026-11-10T20:17:23+00:00","first_seen_at":"2026-11-10T20:46:01+00:00","fetched_at":"2026-11-10T20:46:01+00:00","note":null}],"documents":[{"id":118126,"url":"https://github.com/Worklenz/worklenz/commit/f58c7dbcc68fcda31a5cd4ce68d02af7ea8c37e1","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":118127,"url":"https://github.com/Worklenz/worklenz/releases/tag/v3.3.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":118128,"url":"https://www.vulncheck.com/advisories/worklenz-sql-injection-via-reporting-members-endpoint","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}