SQL Injection Vulnerability in Apache Fineract's Report Execution API
CVE-2026-35152

8.8HIGH

Key Information:

Vendor

Apache
Status
Apache Fineract
Vendor
CVE Published:
15 July 2026

What is CVE-2026-35152?

A SQL Injection vulnerability has been identified in the Report Execution API of Apache Fineract, specifically within the runreports endpoint. This issue arises from inadequate validation of report parameter values incorporated into the SQL queries, enabling an authenticated user—with the necessary permissions to run reports—to inject arbitrary SQL commands. Exploiting this vulnerability can lead to unauthorized access to sensitive data that the report was not meant to reveal. Users are advised to upgrade to the latest version where this vulnerability has been addressed.

Affected Version(s)

Apache Fineract 0 <= 1.14.0

References

https://github.com/apache/fineract/pull/5980
patch
https://lists.apache.org/thread/d3bzcwsbywz7wg9zxvtlkvgmf...
vendor-advisory
https://lists.apache.org/thread/658yddn0bpxqw2hpxnyk3vqd0...
vendor-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

JD Security Shenyi Team
Geo Chen
Quac Tran
Terence Monteiro (@terencemo)
Ádåm Såghy (@adamsaghy)
Aleksandar Vidakovic (@vidakovic)
.