Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract sensitive database content including password hashes from other tenants. This is an incomplete fix for CVE-2026-25947.

Worklenz through version 3.0.0 contains a SQL injection vulnerability in its pagination helper functions due to improper validation of the sort-field query parameter. Authenticated users can inject arbitrary PostgreSQL expressions into ORDER BY clauses. The vulnerability enables time-based and boolean-based blind SQL injection attacks. Attackers can exploit this to extract sensitive database content, including password hashes belonging to other tenants, posing a cross-tenant data exposure risk. This issue is classified as an incomplete fix for a prior vulnerability, CVE-2026-25947. The affected code is located in the job-titles-controller and worklenz-controller-base files in the backend. A GitHub security advisory (GHSA-f2f8-2ppj-85pf) and a VulnCheck advisory have been published. Organizations using Worklenz 3.0.0 or earlier should apply patches or mitigations immediately given the high severity and potential for sensitive data leakage.