The vulnerability is an authorization bypass that occurs because Worklenz does not verify that a requester’s organization owns the task when resolving task‑scoped API endpoints. This flaw allows an authenticated user to request any task by UUID and receive confidential information—such as work logs, comments, attachments, and project details—belonging to another organization. The weakness is a classic example of CWE‑639, where user input determines authorization decisions. The primary consequence is disclosure of sensitive tenant data, potentially compromising confidentiality and privacy across organizations.

The affected system is the Worklenz collaboration platform published by Worklenz. All releases prior to 3.0.0 are vulnerable; this includes the current code base referenced in the GitHub repository before the v3.0.0 release. The issue is tied to the verify‑task‑access middleware and the task‑scoped endpoints that handle task identifiers.

The vulnerability carries a CVSS score of 7.1, indicating high severity. No EPSS score is available, so the likelihood of exploitation is unknown, but the flaw is not listed in CISA’s KEV catalog. The attack vector requires authentication, so an attacker must first obtain valid credentials for the platform. Once authenticated, the attacker can repeatedly query task endpoints with arbitrary UUIDs to exfiltrate data from other tenants. Given its moderate‑high CVSS rating and the ease of exploitation in environments where tenant isolation is critical, the risk to organizations that have not yet updated to v3.0.0 is significant.