{"affected":[{"defaultStatus":"unaffected","ecosystem":"github","packageName":"Worklenz/worklenz","product":"worklenz","source":"CNA: VulnCheck","vendor":"Worklenz","versions":[{"lessThan":"3.3.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-104060","cwes":["CWE-89"],"description":"Worklenz before 3.3.0 contains an SQL injection vulnerability in the reporting members endpoints that allows authenticated attackers to read arbitrary database contents by injecting SQL through the projects and status parameters. Attackers can send crafted values to POST /api/v1/reporting/members/all or GET /api/v1/reporting/members/export, which are interpolated unparameterized into IN clauses in getTeamMemberInsightData, and use time-based blind techniques to extract data across tenants, including user password hashes.","epss":{"date":"2026-11-13","percentile":0.23845,"score":0.00307},"exploits":[],"kev":null,"metrics":[{"score":7.1,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"},{"score":6.5,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},{"score":7.1,"severity":"high","source":"NVD: disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"},{"score":6.5,"severity":"medium","source":"NVD: disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1794625321049,"publishedAt":1794340551397,"references":[{"source":"CNA: VulnCheck","tags":["release-notes"],"url":"https://github.com/Worklenz/worklenz/releases/tag/v3.3.0"},{"source":"CNA: VulnCheck","tags":["patch","issue-tracking"],"url":"https://github.com/Worklenz/worklenz/pull/624"},{"source":"CNA: VulnCheck","tags":["issue-tracking","patch"],"url":"https://github.com/Worklenz/worklenz/commit/f58c7dbcc68fcda31a5cd4ce68d02af7ea8c37e1"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/worklenz-sql-injection-via-reporting-members-endpoint"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/Worklenz/worklenz/commit/f58c7dbcc68fcda31a5cd4ce68d02af7ea8c37e1"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/Worklenz/worklenz/pull/624"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/Worklenz/worklenz/releases/tag/v3.3.0"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://www.vulncheck.com/advisories/worklenz-sql-injection-via-reporting-members-endpoint"}],"remediation":[{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/Worklenz/worklenz/pull/624"},{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/Worklenz/worklenz/commit/f58c7dbcc68fcda31a5cd4ce68d02af7ea8c37e1"}],"revision":"fe1d2f40b34d4833b0ba18cc2d813ac180e18032921864a2c674afb56134d861","sources":[{"modifiedAt":1794625321049,"name":"CNA: VulnCheck","retrievedAt":1794629297828,"url":"https://www.cve.org/CVERecord?id=CVE-2026-104060"},{"modifiedAt":1794519366743,"name":"NVD","retrievedAt":1794529280369,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104060"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794629329558,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104060"}],"ssvc":{"assessedAt":1794625311393,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Worklenz < 3.3.0 SQL Injection via Reporting Members Endpoint","updatedAt":1794629329558}