---
id: "CVE-2026-104060"
page: "https://infrastack.ai/live/CVE-2026-104060"
kind: "vulnerability"
aliases: ["CVE-2026-104060"]
title: "Worklenz: SQL injection in reporting endpoints exposes database contents"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Worklenz", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["package", "self-hosted", "sql", "worklenz"]
not_affected_if: ["no-authenticated-users", "version-3.3.0-or-later"]
published_at: "2026-11-10T20:17:23+00:00"
first_seen_at: "2026-11-10T20:46:01+00:00"
updated_at: "2026-11-10T20:47:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104060", "first_seen_at": "2026-11-10T20:46:01+00:00"}]
exploit_sources: []
---

# Worklenz: SQL injection in reporting endpoints exposes database contents

Link for people: https://infrastack.ai/live/CVE-2026-104060 (this .md is for agents)

Worklenz before 3.3.0 lets an authenticated user inject SQL through the projects and status parameters of its reporting members endpoints. An attacker can read arbitrary database contents, including user password hashes, across tenants using time-based blind techniques.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Worklenz affected range not listed fixed no fixed version listed

## How to check

- Check the Worklenz version you run; the sources say versions before `3.3.0` are affected.
- Look for the endpoints `POST /api/v1/reporting/members/all` and `GET /api/v1/reporting/members/export` in your deployment.

## Fix

- Worklenz: upgrade to `3.3.0` or later.

## Timeline

- 2026-11-10T20:46:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-104060

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/worklenz-sql-injection-via-reporting-members-endpoint
- [fix] Patch: github.com https://github.com/Worklenz/worklenz/commit/f58c7dbcc68fcda31a5cd4ce68d02af7ea8c37e1
- [fix] Release notes: github.com https://github.com/Worklenz/worklenz/releases/tag/v3.3.0

## From the sources

Worklenz before 3.3.0 contains an SQL injection vulnerability in the reporting members endpoints that allows authenticated attackers to read arbitrary database contents by injecting SQL through the projects and status parameters. Attackers can send crafted values to POST /api/v1/reporting/members/all or GET /api/v1/reporting/members/export, which are interpolated unparameterized into IN clauses in getTeamMemberInsightData, and use time-based blind techniques to extract data across tenants, including user password hashes.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_