SQL Injection Vulnerability in ProcessMaker Workflow Management Software
CVE-2026-107803

6.5MEDIUM

Key Information:

Vendor: Processmaker
Status: Processmaker
Vendor: CVE Published:; 9 October 2026

🔔 Create Processmaker Vulnerability Alert

What is CVE-2026-107803?

An SQL injection vulnerability exists in the ProcessMaker workflow management software, specifically in the GET /api/1.0/tasks endpoint, prior to version 2026.14.3. This flaw arises from improper handling of a user-controlled parameter in the query process, allowing authenticated users to execute blind, time-based SQL queries. By exploiting this vulnerability, an attacker can infer and extract sensitive data available to the ProcessMaker database account. The issue has been remediated in version 2026.14.3, highlighting the importance of prompt application updates to safeguard your data.