What is the CVSS score of CVE-2026-56287?

CVE-2026-56287 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Apache Fineract are affected by CVE-2026-56287?

Apache Fineract versions through 1.14.0 contain a SQL injection vulnerability in the Client Search API that allows authenticated users to extract sensitive financial data from the database, including…

How to fix or mitigate CVE-2026-56287?

Within 24 hours, identify all systems running Apache Fineract version 1.14.0 or earlier and audit which users and service accounts hold the view-clients permission; review access logs for suspicious activity on the /api/v1/clients endpoint with unusual orderBy or sortOrder parameters. Within 7 days, restrict view-clients permission to only users and roles that require it, implement network-level access controls to limit Client Search API exposure to trusted systems, and deploy Web Application Firewall rules to detect and block SQL injection patterns in orderBy and sortOrder parameters. Within 30 days, monitor the Fineract project for released patches (a fix PR #6020 is in progress), validate any released patch in a staging environment, and immediately deploy to production once validated.

Apache Fineract CVE-2026-56287

EUVD-2026-44603 HIGH

SQL Injection (CWE-89)

2026-07-15

GHSA-fcf9-3vvc-8qg6

SQLi Apache Fineract

8.1

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable API, low complexity, requires a low-privilege client-view account (PR:L); ORDER BY injection in a SELECT enables data/file read (C:H) but no write path, so I:N and A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 15:31 vuln.today

Analysis Updated

Jul 15, 2026 - 15:31 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 15, 2026 - 15:22 vuln.today

cvss_changed

CVSS changed

Jul 15, 2026 - 15:22 NVD

8.1 (HIGH)

Analysis Generated

Jul 15, 2026 - 08:16 vuln.today

CVE Published

Jul 15, 2026 - 06:40 oss-security

HIGH

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News 9 New Apache Vulnerabilities - 9 High Severity, No Public Exploits Jul 16, 2026

AnalysisAI

Blind boolean-based SQL injection in Apache Fineract's Client Search API (GET /api/v1/clients) through version 1.14.0 lets an authenticated user who holds the view-clients permission concatenate unvalidated orderBy (and sortOrder) parameters directly into the backing SQL query. Attackers can extract arbitrary database contents one bit at a time and, on MySQL/MariaDB back ends, read arbitrary files accessible to the DB process via LOAD_FILE(). There is no public exploit identified at time of analysis, though the vendor's fix PR (#6020) ships an integration test containing a working injection payload; not listed in CISA KEV.

Technical ContextAI

Apache Fineract is an open-source core-banking / microfinance platform built on Spring (Java) that exposes a REST API over a relational database (MySQL/MariaDB/PostgreSQL). The vulnerable code path is ClientReadPlatformServiceImpl.retrieveAll(), which appended searchParameters.getOrderBy() and getSortOrder() straight into a StringBuilder-composed SQL 'order by' clause. The prior defense relied on columnValidator.validateSqlInjection(), which proved insufficient. This is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) - the ORDER BY clause is a context where parameter binding cannot be used, so identifiers must be whitelisted rather than sanitized. The fix introduces an InputValidator with a strict regex allow-list (^(id|(display|office)Name|accountNo|officeId)$) for orderBy and hard-codes sortOrder to ASC/DESC only.

RemediationAI

Upstream fix available (PR/commit https://github.com/apache/fineract/pull/6020); a released, tagged patched version is not independently confirmed from the provided data - monitor https://fineract.apache.org/ and the ASF thread https://lists.apache.org/thread/l5klcj2v0dx63bssvb0gmw1nzzc47col for the fixed release and upgrade to a version above 1.14.0 that includes the InputValidator allow-list. Until a patched build is deployed, restrict the 'view clients' permission (READ_CLIENT) to the minimum set of trusted roles to shrink the pool of accounts that can reach the endpoint, and place a WAF/reverse-proxy rule in front of GET /api/v1/clients that rejects orderBy values not matching ^(id|displayName|officeName|accountNo|officeId)$ and sortOrder values other than ASC/DESC (side effect: any legitimate client using other sort columns will break). On MySQL/MariaDB, revoke the FILE privilege from the Fineract database account and/or set secure_file_priv to blunt the LOAD_FILE() file-disclosure escalation (side effect: disables any legitimate server-side file loading). Enable query logging/monitoring to detect boolean-based probing.