Apache Fineract CVE-2026-35152

Exploitation requires an authenticated Fineract account (PR:L) that has been granted permission to run reports, plus access to the Report Execution API's runreports endpoint; the attacker injects via crafted report parameter values that are passed into the generated SQL. Limiting factors: it is not exploitable pre-authentication (a valid account plus the report-run authorization is mandatory, contradicting the 'Authentication Bypass' tag), affects only versions up to and including 1.14.0, and depends on the account being permitted to execute at least one report. No victim user interaction is needed (UI:N), and no special non-default feature toggle is required - the vulnerable reporting path is standard functionality - so any environment where low-trust users hold report-run rights is realistically exposed.

This is a genuine, actionable priority for any organization running Fineract, though not an unauthenticated internet-wide risk. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8) shows network reach and low attack complexity but explicitly requires privileges (PR:L), consistent with the description's 'authenticated user with permission to run reports.' No EPSS score was supplied, no KEV listing, and no SSVC decision was provided, so automatable/technical-impact cannot be scored from the input. Note a data conflict: the intelligence Tags include 'Authentication Bypass,' but neither the description nor the CVSS vector supports pre-auth exploitation (PR:L, and exploitation is gated on a report-run permission) - treat the 'Authentication Bypass' tag as unverified and likely mislabeled. Also, the description frames impact primarily as unauthorized data access (confidentiality), whereas the base vector rates I:H/A:H; realistic impact skews toward confidentiality for a read-oriented reporting query, so I:H/A:H may be generous depending on the database account's privileges - verify against deployment.

A low-privileged but authenticated Fineract user (for example a branch officer or analyst granted report-run permission) supplies a report and, instead of a normal value, passes a crafted parameter containing SQL syntax such as a UNION SELECT or subquery. Because the value is concatenated into the report's SQL, the injected clause executes and returns rows from tables the user was never authorized to see, such as other clients' financial records or credential/config tables. No public POC is identified at time of analysis, and the network vector with low complexity means exploitation needs only valid low-tier credentials plus the report permission.