Live › vulnerability › CVE-2026-64618
Apache Fineract, a core banking platform, fails to sanitize the outStandingAmountPercentageCondition parameter of its /fineract-provider/api/v1/search/advance API. An attacker can inject SQL that the database executes, which can expose or alter stored financial data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 09:29 UTC. All times on this page are UTC.
Teams running Apache Fineract 1.15.0 or earlier that expose the search API to users or networks they do not fully trust. Deployments that do not run Fineract, or that restrict access to the search endpoint, have less exposure. Sources do not say whether authentication is required to reach the endpoint.
No product ranges from the sources yet.
1.15.0./fineract-provider/api/v1/search/advance that include the outStandingAmountPercentageCondition parameter.1.16.1.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-64618")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.