Apache Fineract CVE-2026-56287

Requires an authenticated account with permission to view clients (CVSS PR:L) and network reachability to the Fineract REST API endpoint GET /api/v1/clients; no user interaction and no special non-default configuration are needed for the base SQL injection, since the vulnerable orderBy handling is present in default builds up to 1.14.0. The file-disclosure escalation is conditional: it requires the database back end to be MySQL or MariaDB and the DB process account to have FILE privileges / readable target files via LOAD_FILE() - it does not apply to PostgreSQL. Limiting factors: an attacker must already possess valid low-privilege credentials, and confidentiality-only impact means this is primarily a data-extraction vector rather than a direct code-execution path.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.1) reflects a network-reachable, low-complexity attack requiring only low privileges and no user interaction. The realistic risk is elevated because Fineract handles sensitive financial/PII data and any legitimate low-privilege operator with client-view rights can weaponize the flaw. However, note a discrepancy: the vector rates I:H, but an ORDER BY injection inside a SELECT enables read/extraction rather than write, so the integrity impact is arguably overstated (see assessed vector). EPSS is not provided, KEV status is NO, and no standalone public PoC is referenced - though the fix commit publicly demonstrates a boolean-based extraction payload, effectively lowering the bar for exploit development. Net: a genuine priority for any organization running Fineract, tempered by the authentication requirement (PR:L) which limits it to insiders or attackers who have already obtained valid credentials.

A low-privileged Fineract user (or an attacker who has phished such credentials) sends GET /api/v1/clients with a crafted orderBy value like 'c.office_id, (CASE WHEN (ASCII(SUBSTRING((SELECT ...),1,1)) - 109) THEN c.id ELSE (c.id*-1) END)', observing the differing row order/response to extract data one boolean at a time. On a MySQL/MariaDB back end the attacker pivots to LOAD_FILE() to read files readable by the DB process. The fix PR publicly includes this exact payload as a regression test, so a working technique is documented even though no packaged exploit was referenced.