{"id":"CVE-2026-65874","kind":"vulnerability","aliases":["CVE-2026-65874"],"related":[],"title":"Apache Fineract: ordering parameters allow blind SQL injection by authenticated users","description":"This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint (GET /api/v1/centers) and the datatable entry read endpoints (GET /api/v1/datatables/{datatable}/{apptableId} and GET /api/v1/datatables/{datatable}/{apptableId}/{datatableId}) concatenate caller-supplied ordering parameters (orderBy, sortOrder, order) directly into the SQL ORDER BY clause. The existing regex-based input validation can be bypassed, allowing time-based blind SQL injection by any authenticated user with read access to centers or to the targeted datatable.\n\nUsers are recommended to upgrade to 1.16.1 which fixes the issue.","summary":"Apache Fineract versions up to and including 1.15.0 pass caller-supplied orderBy, sortOrder and order parameters straight into SQL ORDER BY clauses on the center and datatable read endpoints. An authenticated user can bypass the regex validation and run time-based blind SQL injection to read database contents.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-fineract","java","package","self-hosted"],"not_affected_if":["fineract-1.16.1-or-later"],"how_to_check":"- Check the deployed Fineract version and see whether it is `1.15.0` or earlier\n- Look for the `/api/v1/centers` and `/api/v1/datatables` endpoints being reachable by users with read access","fix":"- Apache Fineract: upgrade to `1.16.1`","status":"open","published_at":"2026-10-30T09:17:15+00:00","first_seen_at":"2026-10-30T09:29:39+00:00","triaged_at":"2026-10-30T09:30:44+00:00","updated_at":"2026-10-30T09:30:44+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T09:30:44Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Fineract: upgrade to `1.16.1`","reach":"network","title":"Apache Fineract: ordering parameters allow blind SQL injection by authenticated users","impact":"medium","summary":"Apache Fineract versions up to and including 1.15.0 pass caller-supplied orderBy, sortOrder and order parameters straight into SQL ORDER BY clauses on the center and datatable read endpoints. An authenticated user can bypass the regex validation and run time-based blind SQL injection to read database contents.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-fineract","java","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"database contents readable through blind SQL injection by authenticated users","analyst_note":"","how_to_check":"- Check the deployed Fineract version and see whether it is `1.15.0` or earlier\n- Look for the `/api/v1/centers` and `/api/v1/datatables` endpoints being reachable by users with read access","plain_action":"","needs_analyst":false,"not_affected_if":["fineract-1.16.1-or-later"],"who_is_affected":"Organisations running Apache Fineract 1.15.0 or earlier, the core banking platform for microfinance. Exposure requires an authenticated account with read access to centers or the affected datatables; deployments where users are fully trusted carry less risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000691,"input_tokens":4246,"output_tokens":532,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-65874':14A,17A '/api/v1/centers':92C '/api/v1/datatables':100C,105C '1.15.0':33B,86C '1.16.1':162C 'access':148C 'affect':78C 'allow':5A,135C 'apach':1A,19B,26B,79C 'apache-fineract':18B 'apptableid':102C,107C 'authent':10A,57B,144C 'base':68B,129C,138C 'blind':6A,69B,139C 'bypass':60B,134C 'caller':36B,111C 'caller-suppli':35B,110C 'center':51B,88C,150C 'claus':48B,124C 'concaten':109C 'content':75B 'cve':12A,15A 'databas':74B 'datat':53B,95C,101C,106C,155C 'datatableid':108C 'direct':118C 'endpoint':55B,90C,98C 'entri':96C 'exist':126C 'fineract':2A,20B,27B,80C 'fix':164C 'get':91C,99C,104C 'host':25B 'includ':32B,85C 'inject':8A,71B,141C 'input':130C 'issu':77C,166C 'java':21B 'order':3A,41B,46B,113C,117C,122C 'orderbi':38B,115C 'packag':22B 'paramet':4A,42B,114C 'pass':34B 'read':54B,73B,89C,97C,147C 'recommend':158C 'regex':62B,128C 'regex-bas':127C 'run':65B 'self':24B 'self-host':23B 'sortord':39B,116C 'sql':7A,45B,70B,121C,140C 'straight':43B 'suppli':37B,112C 'target':154C 'time':67B,137C 'time-bas':66B,136C 'upgrad':160C 'user':11A,58B,145C,156C 'valid':63B,131C 'version':28B,81C","nicknames":[],"mitigations":[],"who_affected":"Organisations running Apache Fineract 1.15.0 or earlier, the core banking platform for microfinance. Exposure requires an authenticated account with read access to centers or the affected datatables; deployments where users are fully trusted carry less risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T09:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65874","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65874","severity":null,"published_at":"2026-10-30T09:17:15+00:00","modified_at":"2026-10-30T09:17:15+00:00","first_seen_at":"2026-10-30T09:29:39+00:00","fetched_at":"2026-10-30T09:29:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}