What is the CVSS score of CVE-2026-35152?

CVE-2026-35152 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Apache Fineract are affected by CVE-2026-35152?

Apache Fineract versions through 1.14.0 contain an authenticated SQL injection vulnerability in the Report Execution API enabling authorized users to bypass data access controls and retrieve…

How to fix or mitigate CVE-2026-35152?

Within 24 hours: inventory all Apache Fineract deployments, document current versions, and audit which accounts hold report-run permissions. Within 7 days: immediately revoke report-run permissions for all users without active business need, restrict access to essential finance and audit personnel only, and enable comprehensive API-level audit logging on the Report Execution API endpoint with monitoring for SQL metacharacters in report parameters. Within 30 days: track Fineract's upstream release cycle for the InputValidator framework introduced in PR #5980, and upon its inclusion in a production release, plan and execute a controlled upgrade to the patched version.

Apache Fineract CVE-2026-35152

EUVD-2026-44604 HIGH

SQL Injection (CWE-89)

2026-07-15

GHSA-9vv4-g2cx-75rq

SQLi Apache Authentication Bypass Fineract

8.8

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.1 HIGH

Network-reachable reporting API with low complexity but requires an authenticated report-run permission (PR:L); impact is primarily unauthorized data read (C:H), with limited integrity and no clear availability impact for a read-oriented report query.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 15:33 vuln.today

Analysis Updated

Jul 15, 2026 - 15:33 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 15, 2026 - 15:22 vuln.today

cvss_changed

CVSS changed

Jul 15, 2026 - 15:22 NVD

8.8 (HIGH)

Analysis Generated

Jul 15, 2026 - 08:16 vuln.today

CVE Published

Jul 15, 2026 - 06:38 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical SQL Injection in Apache Fineract Report API - CVE-2026-35152 Jul 15, 2026

AnalysisAI

SQL injection in Apache Fineract's Report Execution API (the runreports endpoint) in all versions up to and including 1.14.0 lets an authenticated user holding report-run permission inject arbitrary SQL through crafted report parameter values, because those values are concatenated into the generated query without sufficient validation. This yields unauthorized read access to data well beyond what the report was scoped to expose, and by extension other database contents. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate with report-run permission

Delivery

Select a report on runreports endpoint

Exploit

Submit crafted SQL in parameter value

Execution

Injected query executes against DB

Impact

Exfiltrate unauthorized data

Access

Authenticate with report-run permission

Delivery

Select a report on runreports endpoint

Exploit

Submit crafted SQL in parameter value

Execution

Injected query executes against DB

Impact

Exfiltrate unauthorized data

Vulnerability AssessmentAI

Exploitation	Exploitation requires an authenticated Fineract account (PR:L) that has been granted permission to run reports, plus access to the Report Execution API's runreports endpoint; the attacker injects via crafted report parameter values that are passed into the generated SQL. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine, actionable priority for any organization running Fineract, though not an unauthenticated internet-wide risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A low-privileged but authenticated Fineract user (for example a branch officer or analyst granted report-run permission) supplies a report and, instead of a normal value, passes a crafted parameter containing SQL syntax such as a UNION SELECT or subquery. Because the value is concatenated into the report's SQL, the injected clause executes and returns rows from tables the user was never authorized to see, such as other clients' financial records or credential/config tables. …
Remediation	Upgrade to a fixed release of Apache Fineract above 1.14.0 that incorporates PR #5980 (https://github.com/apache/fineract/pull/5980); the input does not specify an exact tagged release number, so this is an upstream fix available (PR/commit) with the released patched version not independently confirmed - confirm the target version against the Apache Fineract announcement threads before deploying. … Detailed patch versions, workarounds, and compensating controls in full report.