SQL Injection Vulnerability in Apache Fineract's Report Execution API

CVE-2026-35152

What is CVE-2026-35152?

A SQL Injection vulnerability has been identified in the Report Execution API of Apache Fineract, specifically within the runreports endpoint. This issue arises from inadequate validation of report parameter values incorporated into the SQL queries, enabling an authenticated user—with the necessary permissions to run reports—to inject arbitrary SQL commands. Exploiting this vulnerability can lead to unauthorized access to sensitive data that the report was not meant to reveal. Users are advised to upgrade to the latest version where this vulnerability has been addressed.

References