Authorization Bypass in Worklenz Affects Task Data Access

CVE-2026-85389

What is CVE-2026-85389?

Worklenz prior to version 3.0.0 contains a vulnerability where the application fails to validate ownership of tasks by organization. This oversight permits authenticated users to exploit task-scoped API endpoints, potentially leading to unauthorized access of another organization's task data. Attackers can manipulate task UUIDs to retrieve sensitive information such as work logs, comments, attachments, and overall project insights belonging to different tenants, posing significant privacy risks.

References