Do Son 
TL;DR
Apache has patched three SQL injection flaws in Fineract, the open-source core banking platform. The Apache Fineract SQL injection bugs, CVE-2026-57821, CVE-2026-56287, and CVE-2026-35152, all abuse unvalidated query parameters. Each requires an authenticated user with specific permissions. Version 1.15.0 is unaffected, and no in-the-wild exploitation has been confirmed.
Why It Matters
Fineract powers banking and microfinance systems that hold sensitive financial data. SQL injection lets an attacker read data far beyond their normal reach. One flaw even enables local file disclosure on MySQL and MariaDB. Another can exhaust the database connection pool and trigger a denial of service. Consequently, these bugs threaten both confidentiality and availability.
How the Attacks Work
CVE-2026-57821: Office API orderBy Injection
The Office Search API concatenates the orderBy parameter into a SQL query. As a result, an authenticated user can inject a subquery for time-based blind extraction. This flaw bypasses the ColumnValidator fix from CVE-2024-32838, which misses bare subqueries in the ORDER BY position.
CVE-2026-56287: Client API File Disclosure
The Client Search API mishandles the orderBy and sortOrder parameters. On MySQL and MariaDB, an attacker can call LOAD_FILE() to read files the database process can access.
CVE-2026-35152: runreports Injection
The Report Execution API folds report parameter values into SQL without proper validation. A user with report permissions can then reach data the report never intended to expose.
- Total: 3 CVEs
- Severity: 3 High
- Actively exploited: None confirmed
- Highest severity: 8.8 (High · CVSSv3) — CVE-2026-35152
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-35152 | 8.8 | CWE-89 | — | Not exploited |
| CVE-2026-57821 | 8.1 | CWE-89 | 1.15.0 | Not exploited |
| CVE-2026-56287 | 8.1 | CWE-89 | — | Not exploited |
Affected Versions
All three flaws affect Apache Fineract up to and including 1.14.0. Apache confirms that version 1.15.0 is not affected.
Patch and Mitigation Steps
Upgrade to Apache Fineract 1.15.0 from the official downloads page. In the meantime, tighten the office, client, and report permissions that gate these APIs. Reviewing database logs for unusual ORDER BY activity can also help. Least-privilege database accounts limit the blast radius of any successful injection.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
