This vulnerability arises in ProcessMaker’s "/api/1.0/tasks" endpoint when the order_by parameter is concatenated directly into a SQL query without validation. The flaw allows any authenticated user to craft queries that, through blind or time‑based techniques, retrieve data that the ProcessMaker database account can access. The primary effect is data exfiltration, not arbitrary code execution, but it grants attackers insight into process and task details that could be leveraged for further attacks.

All ProcessMaker installations running a version earlier than 2026.14.3 are affected. The service exposes the vulnerable endpoint for authenticated users, meaning any user with valid credentials can exploit the flaw. The issue is fixed in ProcessMaker version 2026.14.3 and later.

With a CVSS score of 6.5 the flaw is considered moderate severity. The exploit requires authentication, which limits the attack surface but still permits any legitimate user to extract sensitive data. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no publicly documented exploitation yet. However, the potential for data leakage remains significant, especially if the ProcessMaker account has broad database access.