Do Son The ASF patched Apache security vulnerabilities with new Apache security fixes for Syncope, Arrow, and Fineract, including critical flaw CVE-2026-64618.
Apache Fineract
Three Apache Fineract SQL injection flaws (CVE-2026-57821, CVE-2026-56287, CVE-2026-35152) let authenticated users exfiltrate data. Upgrade to 1.15.0.
A flaw in Apache Fineract risks Authorization Bypass via IDOR (CVE-2025-58137) in its self-service API, potentially exposing customer data. Also fixed: Weak Password Policy and Unmasked Server Keys. Update to v1.13.0.
Learn about CVE-2024-32838, a critical vulnerability in Apache Fineract affecting financial institutions. Stay informed.
CVE-2024-23538 and CVE-2024-23539: These vulnerabilities stem from improper neutralization of special elements used in an SQL command
The CVE-2023-25196 vulnerability also involves improper neutralization of special elements used in SQL commands.
CVE-2022-44635 allowed an authenticated user to perform RCE due to a path traversal flaw in a file upload component of Apache Fineract