Not rated
CVE-2026-56287 A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/v1/clients) in…
Description
A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/v1/clients) in versions up to and including 1.14.0. The orderBy and sortOrder request parameters are concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view clients to inject arbitrary SQL via a crafted orderBy value. This can be leveraged to perform blind boolean-based data extraction and, on MySQL/MariaDB, to disclose arbitrary files readable by the database process via the LOAD_FILE() function. Users are recommended to upgrade to a version containing the fix
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Fineract 1.14 | earliest → 1.14.0 | No fix stated |
References
- lists.apache.org lists.apache.org
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of Apache Fineract
The 22 CVEs of Apache Fineract →
CVE-2026-64618
Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache…
Not rated
CVE-2026-65874
This issue affects Apache Fineract versions up to and including 1.15.0
Not rated
CVE-2026-57821
A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET /api/v1/offices) in versions up to…
Not rated
CVE-2026-35152
A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to…
Not rated