Worklenz up to version 3.0.0 does not validate the sort‑field query parameter used in pagination helper functions. This omission allows an authenticated user to inject arbitrary PostgreSQL expressions into ORDER BY clauses. The vulnerability can be exploited with time‑based or boolean‑based blind techniques to read sensitive data, including password hashes belonging to other tenants, exposing confidentiality across the platform. The flaw is a classic SQL injection (CWE‑89).

The affected product is Worklenz, with all releases up to and including 3.0.0 vulnerable. Users who are logged in to any tenant instance of Worklenz before the fix are at risk.

The CVSS score of 8.6 signals a high severity. While no EPSS score is available, the vulnerability is documented and publicly disclosed; it is not listed in the CISA KEV catalog. Exploitation requires the victim to be authenticated, but the attacker can use standard blind injection techniques against pages that accept a sort‑field parameter. Because cross‑tenant data can be extracted, the impact is systemic and could affect all users in the environment if any tenant is compromised.