CVE-2026-65874

Apache Fineract: SQL injection

Risk score: 57/100
CVSS: 8.8 v3.1
Exploit chance (30 days): 0.3%
Published: 30 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint (GET /api/v1/centers) and the datatable entry read endpoints (GET /api/v1/datatables/{datatable}/{apptableId} and GET /api/v1/datatables/{datatable}/{apptableId}/{datatableId}) concatenate caller-supplied ordering paramete…
Affected: Apache Fineract before 1.16.1
Fix: Upgrade Apache Fineract to 1.16.1 or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Apache Fineract: Amber, patch this week. A SQL injection vulnerability exists in Apache Fineract due to insufficient input neutralization, allowing attackers to inject malicious SQL commands. This could lead to high impact, including the ability to read, modify, or delete sensitive data, and potentially take control of the system.

The flaws

CVE-2026-65874: SQL injection (CVSS 8.8 · EPSS 0%)
CVE-2026-64618: SQL injection (CVSS 9.8 · EPSS 0%)

The fix

Upgrade Apache Fineract: 1.16.1 or later on your release line

Who is exposed: {'products': ['Apache Fineract'], 'packages': [], 'versions': ['through 1.15.0']}

Where it stands

No known exploitation

Connects to

Same weakness: SQL injection (CWE-89). 399 other warnings in 30 days

Why it is Yellow

CVSS 8.8 high

References

Original description

This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint (GET /api/v1/centers) and the datatable entry read endpoints (GET /api/v1/datatables/{datatable}/{apptableId} and GET /api/v1/datatables/{datatable}/{apptableId}/{datatableId}) concatenate caller-supplied ordering parameters (orderBy, sortOrder, order) directly into the SQL ORDER BY clause. The existing regex-based input validation can be bypassed, allowing time-based blind SQL injection by any authenticated user with read access to centers or to the targeted datatable. Users are recommended to upgrade to 1.16.1 which fixes the issue.

Last activity 30 Oct 2026. Patch Forecast updates every hour.