{"id":"CVE-2026-64618","kind":"vulnerability","aliases":["CVE-2026-64618"],"related":[],"title":"Apache Fineract: SQL injection in search endpoint lets attackers run database queries","description":"Improper Neutralization of Special Elements used in an SQL Command (\"SQL Injection\") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue.","summary":"Apache Fineract, a core banking platform, fails to sanitize the outStandingAmountPercentageCondition parameter of its /fineract-provider/api/v1/search/advance API. An attacker can inject SQL that the database executes, which can expose or alter stored financial data.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-fineract","banking","package","self-hosted"],"not_affected_if":["fineract-1.16.1-or-later"],"how_to_check":"- Check the Fineract version in use; affected versions are those through `1.15.0`.\n- Look for requests to `/fineract-provider/api/v1/search/advance` that include the outStandingAmountPercentageCondition parameter.","fix":"- Upgrade Apache Fineract to `1.16.1`.","status":"open","published_at":"2026-10-30T09:17:15+00:00","first_seen_at":"2026-10-30T09:29:39+00:00","triaged_at":"2026-10-30T09:30:45+00:00","updated_at":"2026-10-30T09:30:45+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T09:30:45Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Fineract to `1.16.1`.","reach":"network","title":"Apache Fineract: SQL injection in search endpoint lets attackers run database queries","impact":"high","summary":"Apache Fineract, a core banking platform, fails to sanitize the outStandingAmountPercentageCondition parameter of its /fineract-provider/api/v1/search/advance API. An attacker can inject SQL that the database executes, which can expose or alter stored financial data.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-fineract","self-hosted","banking"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker reads or modifies loan and customer data in the database","analyst_note":"Confirm whether the search endpoint requires authentication and what the default configuration exposes, via the NVD entry or the Apache Fineract security advisory.","how_to_check":"- Check the Fineract version in use; affected versions are those through `1.15.0`.\n- Look for requests to `/fineract-provider/api/v1/search/advance` that include the outStandingAmountPercentageCondition parameter.","plain_action":"","needs_analyst":true,"not_affected_if":["fineract-1.16.1-or-later"],"who_is_affected":"Teams running Apache Fineract 1.15.0 or earlier that expose the search API to users or networks they do not fully trust. Deployments that do not run Fineract, or that restrict access to the search endpoint, have less exposure. Sources do not say whether authentication is required to reach the endpoint.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000713,"input_tokens":4182,"output_tokens":590,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-64618':15A,18A '/fineract-provider/api/v1/search/advance':41B,88C '1.15.0':79C '1.16.1':107C 'affect':82C 'allow':92C 'alter':56B 'apach':1A,20B,27B,75C 'apache-fineract':19B 'api':42B,90C 'attack':9A,44B 'bank':22B,31B 'command':69C 'core':30B 'cve':13A,16A 'data':59B 'databas':11A,50B 'due':95C 'element':64C 'endpoint':7A,91C 'execut':51B 'exist':73C 'expos':54B 'fail':33B 'financi':58B 'fineract':2A,21B,28B,76C 'fix':110C 'host':26B 'http':89C 'improp':60C 'inject':4A,46B,71C,94C 'input':98C 'insuffici':97C 'issu':112C 'let':8A 'neutral':61C,99C 'outstandingamountpercentagecondit':37B,84C 'packag':23B 'paramet':38B,85C 'platform':32B 'queri':12A 'recommend':102C 'run':10A 'sanit':35B 'search':6A 'self':25B 'self-host':24B 'special':63C 'sql':3A,47B,68C,70C,93C 'store':57B 'upgrad':104C 'use':65C 'user':100C 'version':78C,106C 'vulner':72C,81C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache Fineract 1.15.0 or earlier that expose the search API to users or networks they do not fully trust. Deployments that do not run Fineract, or that restrict access to the search endpoint, have less exposure. Sources do not say whether authentication is required to reach the endpoint.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T09:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-64618","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64618","severity":null,"published_at":"2026-10-30T09:17:15+00:00","modified_at":"2026-10-30T09:17:15+00:00","first_seen_at":"2026-10-30T09:29:39+00:00","fetched_at":"2026-10-30T09:29:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}