{"id":"CVE-2026-107803","revision":"4357c38d9ef74540b256976070b757d0","records":[{"revision":"4357c38d9ef74540b256976070b757d0","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-107803","aliases":[],"title":"ProcessMaker has SQL injection in the tasks endpoint through the order_by parameter","description":"ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the `GET /api/1.0/tasks` endpoint in ProcessMaker is vulnerable to SQL injection through the order_by parameter because `ProcessMaker\\Traits\\TaskControllerIndexMethods::applyColumnOrdering()` concatenates a user-controlled process_requests column name into a DB::raw() SQL subquery without validation or parameter binding. Any authenticated user can use blind, time-based queries to infer and extract data accessible to the ProcessMaker database account. This issue is fixed in version 2026.14.3.","state":0,"publishedAt":"2026-10-09T13:40:16.993+00:00","modifiedAt":"2026-10-09T17:32:10.883+00:00","affected":[{"ecosystem":"Vendor product","name":"processmaker","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"ProcessMaker\",\n                    \"product\": \"processmaker\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 2026.14.3\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/ProcessMaker/processmaker/security/advisories/GHSA-xf7p-gp7c-w7gh","https://github.com/ProcessMaker/processmaker/pull/9041","https://github.com/ProcessMaker/processmaker/commit/2622b7ae810e02c47157028331c45470567e7b79","https://github.com/ProcessMaker/processmaker/releases/tag/v2026.14.3"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-107803","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-107803","identifiers":["CVE-2026-107803"]},"retained":false,"historicalAffected":[]}],"coverage":[]}