Apache Fineract CVE-2025-58130

The target must be a running Apache Fineract instance at or below version 1.11.0 that is network-reachable by the attacker. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special non-default configuration are indicated as required. The practical limiting factors are: deployment scope (Fineract is typically an internal/back-office core-banking system, so exposure depends on whether the instance is reachable by the attacker rather than public-internet-facing by default) and version (fixed in 1.12.1; 1.11.0 and earlier affected). The one-line description does not name a specific feature, protocol endpoint, or configuration setting that gates the credential exposure, so the exact triggering component could not be extracted and should be confirmed from the Apache advisory thread.

Signals are moderately consistent but point to a lower real-world urgency than the 9.1 CVSS score alone suggests. The provided CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality and integrity impact, which is why the base score is Critical. However, EPSS is only 0.43% (35th percentile), indicating low modeled probability of near-term exploitation, and the vulnerability is NOT in CISA KEV and has no public exploit identified at time of analysis. No SSVC decision data was provided. There is tension worth flagging: CWE-522 (Insufficiently Protected Credentials) and the 'Information Disclosure' tag most naturally map to a confidentiality loss, yet the vector asserts I:H as well - the one-line description gives no detail to confirm how integrity is affected, so the I:H rating should be verified against the Apache advisory. Net assessment: a genuinely serious design/credential-handling defect in a banking platform that warrants prompt patching due to the sensitivity of the data, but currently a patch-on-schedule priority rather than emergency, given no exploitation evidence and low EPSS.

A remote, unauthenticated attacker interacts with an internet-reachable or internally-reachable Apache Fineract instance (version 1.11.0 or earlier) and retrieves credentials that the application stores or transmits without sufficient protection. Because the CVSS vector is AV:N/AC:L/PR:N, no special access or user interaction is needed, and the recovered credentials could then be reused to access banking/account data. No public proof-of-concept exploit code was identified at time of analysis.