Riskcovery

CVE-2026-65874

Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints

State
Published
Severity
Not scored
Published
Oct 30, 2026
Updated
Oct 30, 2026
Reserved
Jul 23, 2026

Read the record on cve.org

Description

This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint (GET /api/v1/centers) and the datatable entry read endpoints (GET /api/v1/datatables/{datatable}/{apptableId} and GET /api/v1/datatables/{datatable}/{apptableId}/{datatableId}) concatenate caller-supplied ordering parameters (orderBy, sortOrder, order) directly into the SQL ORDER BY clause. The existing regex-based input validation can be bypassed, allowing time-based blind SQL injection by any authenticated user with read access to centers or to the targeted datatable.

Users are recommended to upgrade to 1.16.1 which fixes the issue.

Scores

The record has no CVSS score.

Weaknesses

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

ProductVersions
Apache FineractApache Software Foundation
  • 1.15.0 and earlierAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.