{"id":"CVE-2026-107803","summary":"ProcessMaker has SQL injection in the tasks endpoint through the order_by parameter","details":"ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the `GET /api/1.0/tasks` endpoint in ProcessMaker is vulnerable to SQL injection through the order_by parameter because `ProcessMaker\\Traits\\TaskControllerIndexMethods::applyColumnOrdering()` concatenates a user-controlled process_requests column name into a DB::raw() SQL subquery without validation or parameter binding. Any authenticated user can use blind, time-based queries to infer and extract data accessible to the ProcessMaker database account. This issue is fixed in version 2026.14.3.","aliases":["GHSA-xf7p-gp7c-w7gh"],"modified":"2026-10-11T02:46:43.200303053Z","published":"2026-10-09T13:40:16.993Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-89"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107803.json"},"references":[{"type":"WEB","url":"https://github.com/ProcessMaker/processmaker/releases/tag/v2026.14.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107803.json"},{"type":"ADVISORY","url":"https://github.com/ProcessMaker/processmaker/security/advisories/GHSA-xf7p-gp7c-w7gh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107803"},{"type":"FIX","url":"https://github.com/ProcessMaker/processmaker/commit/2622b7ae810e02c47157028331c45470567e7b79"},{"type":"FIX","url":"https://github.com/ProcessMaker/processmaker/pull/9041"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/processmaker/processmaker","events":[{"introduced":"0"},{"fixed":"2622b7ae810e02c47157028331c45470567e7b79"},{"fixed":"520e40312e0dfad06366fbedb4e9d0dc05683b81"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"2026.14.3"}]}}],"versions":["v2026.9.3","v2026.10.1","v2026.14.2","v2026.14.1","v2026.13.3","v2026.13.2","v2026.11.1","v2026.13.1","v2026.12.3","v2026.12.3-RC1","v2026.12.2","v2026.12.1","v2026.10.4","v2026.12.1-RC1","v2026.11.2","v2026.10.5","v2026.10.6","v2026.9.4","v2026.10.3","v2026.10.2","v2026.9.2","v2026.7.1","v2026.9.1","v2026.8.2","v2026.7.2","v2026.7.3","v2026.8.1","v2026.6.3","v2026.6.2","v2026.6.1","v2026.5.2","v2026.5.3","v2026.5.1","v2026.4.5","v2026.4.4","v2026.4.3","v2026.4.2","v2026.4.1","v2026.3.5","v2026.3.4","v2026.3.2","v2026.3.3","v2026.2.4","v2026.3.1","v2026.2.3","v2026.2.2","v2026.2.1","v4.15.10","v2026.1.2","v2026.1.1","v4.15.11+mt","v4.15.11+patch-a","v4.15.11","v4.15.11+beta-2","v4.15.11-RC1","v4.15.11+beta-3","v4.15.10+patch-a","v4.15.11+beta-1","v4.15.10-RC1","v4.15.10+beta-3","v4.15.10+beta-2","v4.15.10+beta-1","v4.15.9","v4.15.9-RC1","v4.15.9+beta-3","v4.15.9+beta-2","v4.15.9+beta-1","v4.15.9+beta=1","v4.15.9+alpha-1","vv4.15.9+alpha-1","v4.15.7+patch-a","v4.15.7+patch-b","v4.15.6+patch-a","v4.15.6","v4.15.7-patch-a","v4.15.7","v4.15.7-RC1","v4.15.7+beta-4","v4.15.7+beta-3","v4.15.7+beta-2","v4.15.7+beta-1","v4.15.6-RC1","v4.15.6+beta-4","v4.15.6+beta-5","v4.15.5","v4.15.6+beta-3","v4.15.5-RC2","v4.15.6+beta-2","v4.15.6+beta-1","v4.15.5+beta-4","v4.15.5-RC1","v4.15.5+beta-3","v4.15.3","v4.15.5+beta-2","v4.15.5+beta-1","v4.15.4-RC2","v4.15.4-RC1","v4.15.4+beta-2","v4.15.4+beta-3","v4.15.4+beta-1","v4.15.3+beta-1","v4.15.3-RC1","v4.15.2","v4.15.2+beta-1","v4.15.2-RC1","v4.15.1","v4.15.1-RC1","v4.15.1+beta-2","v4.15.1+beta-1","v4.15.0","v4.15.0+beta-1","v4.15.0-RC1","v4.14.2","v4.14.2-RC1","v4.14.2+beta-2","v4.14.2+beta-1","v4.14.1","v4.14.1-RC1","v4.14.0","v4.14.0-RC1","v4.14.0-RC2","v4.14.0+beta-7","v4.14.0+beta-6","v4.14.0+beta-5","v4.14.0+beta-4","v4.14.0+beta-2","v4.14.0+beta-3","v4.14.0+beta-1","v4.14.0+alpha-2","v4.14.0+alpha-1","v4.13.0-RC1","v4.12.2","v4.12.1","v4.12.0-RC1","v4.12.0","v4.12.0+beta-5","v4.12.1-RC1","v4.12.0+beta-4","v4.12.0+beta-3","v4.12.0+beta-2","v4.12.0+beta-1","v4.12.0+alpha-3","v4.12.0+alpha-2","v4.11.5-RC2","v4.11.4","v4.11.5-RC1","v4.11.2-RC2","v4.11.2-RC1","v4.11.4-RC1","v4.11.3","v4.11.2","v4.11.1","v4.11.2-RC3","v4.11.0-RC1","v4.11.0","v4.11.1-RC3","v4.11.1-RC2","v4.11.1-RC1","v4.11.0-RC2","v4.11.0+beta-3","v4.11.0+beta-2","v4.11.0+beta-1","v4.10.1","v4.10.2-RC1","v4.10.1-RC1","v4.10.0","v4.10.0-RC4","v4.10.0-RC3","v4.10.0-RC2","v4.10.0-RC1","v4.10.0+nightly-20240422","v4.10.0+beta-2","v4.10.0+beta-1","v4.10.0+alpha-3","v4.9.2","v4.8.2","v4.8.1","v4.8.0","v4.8.1+nightly-20231123","v4.8.1+nightly-20231122","v4.8.0-RC2","v4.8.0+nightly-20231113","v4.7.1","v4.7.1+beta-2","v4.7.1+beta-1","nightly-20230831C","v4.7.1+nightly-20230831B","v4.7.1+nightly-20230821","v4.7.1+nightly-20230818","v4.7.1+nightly-20230816","v4.7.1+nightly-20230817","v4.7.1+nightly-20230815","v4.7.1+nightly-20230814","v4.7.0+nightly-20230809","v4.7.1+alpha-1","v4.7.0","v4.7.0+nightly-20230808","v4.7.0+beta-2","v4.7.0+nightly-20230807","v4.7.0+nightly-20230804","v4.7.0+nightly-20230803","v4.7.0+beta-1","v4.7.0+nightly-20230728","v4.7.0+nightly-20230725","v4.7.0+nightly-20230721","v4.7.0+nightly-20230720","v4.7.0+nightly-20230719","v4.7.0+nightly-20230718","v4.7.0+alpha-5","v4.7.0+alpha-3","v4.7.0+alpha-2","v4.7.0+alpha-1","v4.6.1","v4.6.0","v4.6.0-RC8","v4.6.0-RC7","v4.6.0-RC6","v4.6.0-RC5","v4.6.0-RC4","v4.5.0","v4.6.0-RC3","v4.6.0-RC2","v4.6.0-RC1","v4.5.0-RC1","v4.5.0-RC5","v4.5.0-RC4","v4.5.0-RC3","v4.5.0-RC2","v4.4.0","v4.4.0-RC7","v4.4.0-RC6","v4.4.0-RC5","v4.4.0-RC4","v4.4.0-RC3","v4.4.0-RC2","v4.4.0-RC1","v4.3.0-RC6","v4.3.0-RC5","v4.3.0-RC4","v4.3.0-RC3","v4.3.0-RC2","v4.2.35","v4.3.0-RC1","v4.2.35-RC4","v4.2.35-RC1","v4.2.35-RC3","v4.2.35-RC2","v4.2.34","v4.2.34-RC2","v4.2.34-RC1","v4.2.30","v4.2.33","v4.2.33-RC1","v4.2.32","v4.2.32-RC1","v4.2.32-RC2","v4.2.31","v4.2.31-RC2","v4.2.31-RC1","v4.2.30-RC4","v4.2.30-RC5","v4.2.30-RC3","v4.2.30-RC2","v4.2.30-RC1","v4.2.29-RC2","v4.2.29-RC1","v4.2.28","v4.2.27","v4.2.26","v4.2.25","v4.2.24","v4.2.23","v4.2.22","v4.2.21","v4.2.20","v4.2.19","v4.2.18-RC","v4.2.16-RC","v4.2.15-RC","v4.2.14-RC4","v4.2.14-RC3","v4.2.14-RC2","v4.2.14-RC","v4.2.13-rc","v4.2.12-rc2","v4.2.12-rc","v4.2.10","v4.2.9","4.2.5","v4.1.0","v4.0.10","v4.0.9","v4.0.7","v4.0.6","v4.0.5","v4.0.4","v4.0.3","4.0.2","v4.0.1","v4.0.0RC3","v4.0.0GA","v4.0.0","4.0rc2","4.0rc1","beta11-r2","beta11","beta10","beta8.1","beta8","beta7","beta6","beta5.1","beta5","beta4","beta3","beta2.1","beta2","beta1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107803.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}]}