SB2026082564 - Multiple vulnerabilities in Apache Fineract

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026082564

SB2026082564 - Multiple vulnerabilities in Apache Fineract

Published: August 25, 2026

Security Bulletin ID SB2026082564
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) SQL injection (CVE-ID: CVE-2026-56287)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose arbitrary files readable by the database process.

The vulnerability exists due to SQL injection in the Client Search API when processing crafted orderBy and sortOrder request parameters. A remote user can send a specially crafted request to disclose arbitrary files readable by the database process.

Exploitation requires permission to view clients and can also be used for blind boolean-based data extraction. File disclosure via LOAD_FILE() is supported on MySQL and MariaDB.


2) SQL injection (CVE-ID: CVE-2026-35152)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to SQL injection in the runreports endpoint when processing report parameter values. A remote user can send crafted parameter values to disclose sensitive information.

Exploitation requires permission to run reports.


3) SQL injection (CVE-ID: CVE-2026-57821)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information and cause a denial of service.

The vulnerability exists due to SQL injection in the Office Search API (GET /api/v1/offices) when processing a crafted orderBy request parameter. A remote user can supply a crafted orderBy value containing a subquery to disclose sensitive information and cause a denial of service.

Exploitation requires permission to view offices and can be leveraged through time-based blind SQL injection.


Remediation

Install update from vendor's website.

References