---
id: "CVE-2026-64618"
kind: "vulnerability"
aliases: ["CVE-2026-64618"]
title: "Apache Fineract: SQL injection in search endpoint lets attackers run database queries"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-fineract", "banking", "package", "self-hosted"]
not_affected_if: ["fineract-1.16.1-or-later"]
published_at: "2026-10-30T09:17:15+00:00"
first_seen_at: "2026-10-30T09:29:39+00:00"
updated_at: "2026-10-30T09:30:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64618", "first_seen_at": "2026-10-30T09:29:39+00:00"}]
---

# Apache Fineract: SQL injection in search endpoint lets attackers run database queries

Apache Fineract, a core banking platform, fails to sanitize the outStandingAmountPercentageCondition parameter of its /fineract-provider/api/v1/search/advance API. An attacker can inject SQL that the database executes, which can expose or alter stored financial data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Fineract version in use; affected versions are those through `1.15.0`.
- Look for requests to `/fineract-provider/api/v1/search/advance` that include the outStandingAmountPercentageCondition parameter.

## Fix

- Upgrade Apache Fineract to `1.16.1`.

## Timeline

- 2026-10-30T09:29:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-64618

## From the sources

Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_