SQL Injection Vulnerability in Apache Fineract by Apache
CVE-2026-65874

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Fineract
Vendor
CVE Published:
30 October 2026

What is CVE-2026-65874?

A SQL injection vulnerability exists in Apache Fineract versions up to 1.15.0, affecting the Center read endpoint and datatable entry read endpoints. This flaw arises from improperly handled caller-supplied ordering parameters within SQL queries, which can be exploited by authenticated users who have read access. The current input validation is insufficient, allowing an attacker to execute time-based blind SQL injection, potentially leading to unauthorized data exposure. It is recommended that users complete an upgrade to version 1.16.1 to mitigate this risk.

Affected Version(s)

Apache Fineract 0 <= 1.15.0

References

https://github.com/apache/fineract/pull/6230
patch
https://github.com/apache/fineract/pull/6277
patch
https://lists.apache.org/thread/c4q539mkm5blnp5vdb72tzq6r...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abdullah Kareem @cyberkareem
Louis Van der Walt of Lateran Technologies @SuperUserDone
Terence Monteiro @terencemo
Victor Romero @iohacker
.