SQL Injection Vulnerability in Apache Fineract Affecting Specific API Endpoint
CVE-2026-64618

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Fineract
Vendor
CVE Published:
30 October 2026

What is CVE-2026-64618?

An SQL injection vulnerability exists in Apache Fineract due to inadequate neutralization of special elements in the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint. This flaw can be exploited by sending crafted input that manipulates the SQL commands executed by the application, potentially compromising the integrity of the database. Users are strongly advised to upgrade to Apache Fineract version 1.16.1, where this issue has been addressed.

Affected Version(s)

Apache Fineract 0 <= 1.15.0

References

https://github.com/apache/fineract/pull/6153
patch
https://lists.apache.org/thread/s8orckszcd9x4d1qsloc046pp...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

thiscodecc of MoyunSec Vlab and Bing
Adam Saghy (@adamsaghy)
.