What is the CVSS score of CVE-2026-35152?

CVE-2026-35152 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Apache Fineract are affected by CVE-2026-35152?

Apache Fineract versions through 1.14.0 contain an authenticated SQL injection vulnerability in the Report Execution API enabling authorized users to bypass data access controls and retrieve…

How to fix or mitigate CVE-2026-35152?

Within 24 hours: inventory all Apache Fineract deployments, document current versions, and audit which accounts hold report-run permissions. Within 7 days: immediately revoke report-run permissions for all users without active business need, restrict access to essential finance and audit personnel only, and enable comprehensive API-level audit logging on the Report Execution API endpoint with monitoring for SQL metacharacters in report parameters. Within 30 days: track Fineract's upstream release cycle for the InputValidator framework introduced in PR #5980, and upon its inclusion in a production release, plan and execute a controlled upgrade to the patched version.

Apache Fineract CVE-2026-35152

EUVD-2026-44604 HIGH

SQL Injection (CWE-89)

2026-07-15

GHSA-9vv4-g2cx-75rq

Authentication Bypass Apache SQLi Fineract

8.8

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.1 HIGH

Network-reachable reporting API with low complexity but requires an authenticated report-run permission (PR:L); impact is primarily unauthorized data read (C:H), with limited integrity and no clear availability impact for a read-oriented report query.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 15:33 vuln.today

Analysis Updated

Jul 15, 2026 - 15:33 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 15, 2026 - 15:22 vuln.today

cvss_changed

CVSS changed

Jul 15, 2026 - 15:22 NVD

8.8 (HIGH)

Analysis Generated

Jul 15, 2026 - 08:16 vuln.today

CVE Published

Jul 15, 2026 - 06:38 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 2

News 9 New Apache Vulnerabilities - 9 High Severity, No Public Exploits Jul 16, 2026 News Critical SQL Injection in Apache Fineract Report API - CVE-2026-35152 Jul 15, 2026

AnalysisAI

SQL injection in Apache Fineract's Report Execution API (the runreports endpoint) in all versions up to and including 1.14.0 lets an authenticated user holding report-run permission inject arbitrary SQL through crafted report parameter values, because those values are concatenated into the generated query without sufficient validation. This yields unauthorized read access to data well beyond what the report was scoped to expose, and by extension other database contents. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; the upstream fix landed in PR #5980, which introduces a configurable InputValidator/validation-profile framework.

Technical ContextAI

Apache Fineract is an open-source core-banking / financial-services platform (the successor to Mifos) built on Spring and backed by a relational database. Its reporting subsystem lets privileged users execute stored 'Stretchy'/pentaho-style reports whose parameters are supplied at request time via the runreports endpoint and handled through GenericDataService when building the resultset SQL. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): parameter values were interpolated into the SQL string rather than bound as parameters, so classic in-band/UNION-style injection is possible. The fix confirms this - PR #5980 adds a parameterized fillGenericResultSet(String sql, Object... args) overload plus a new InputValidator/DefaultInputValidator, InputValidationException, and FineractInputValidationProperties (named validation patterns and profiles such as 'number'/'date') so report parameters are validated against allow-list patterns before use.

RemediationAI

Upgrade to a fixed release of Apache Fineract above 1.14.0 that incorporates PR #5980 (https://github.com/apache/fineract/pull/5980); the input does not specify an exact tagged release number, so this is an upstream fix available (PR/commit) with the released patched version not independently confirmed - confirm the target version against the Apache Fineract announcement threads before deploying. As compensating controls until patched, tightly restrict report-execution authority: remove the run-reports/READ report permission from all but essential roles so far fewer accounts can reach the runreports endpoint, and where feasible restrict network access to the reporting API to trusted admin networks. Run Fineract's database connection under a least-privilege account (read-only where reporting allows, no access to unrelated schemas or tables) to bound what injected SQL can reach; the trade-off is that legitimate reports needing broader data or writes may break. Enable database query logging and monitoring for anomalous UNION/OR/comment patterns from the report service, accepting added log volume.