Live › vulnerability › CVE-2026-65874
Apache Fineract versions up to and including 1.15.0 pass caller-supplied orderBy, sortOrder and order parameters straight into SQL ORDER BY clauses on the center and datatable read endpoints. An authenticated user can bypass the regex validation and run time-based blind SQL injection to read database contents.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 09:29 UTC. All times on this page are UTC.
Organisations running Apache Fineract 1.15.0 or earlier, the core banking platform for microfinance. Exposure requires an authenticated account with read access to centers or the affected datatables; deployments where users are fully trusted carry less risk.
No product ranges from the sources yet.
1.15.0 or earlier/api/v1/centers and /api/v1/datatables endpoints being reachable by users with read access1.16.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint (GET /api/v1/centers) and the datatable entry read endpoints (GET /api/v1/datatables/{datatable}/{apptableId} and GET /api/v1/datatables/{datatable}/{apptableId}/{datatableId}) concatenate caller-supplied ordering parameters (orderBy, sortOrder, order) directly into the SQL ORDER BY clause. The existing regex-based input validation can be bypassed, allowing time-based blind SQL injection by any authenticated user with read access to centers or to the targeted datatable.
Users are recommended to upgrade to 1.16.1 which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-65874")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.