Apache Fineract CVE-2026-57821

Requires an authenticated Fineract account holding the permission to view offices (CVSS PR:L), and requests must target the Office Search API endpoint GET /api/v1/offices supplying a crafted orderBy parameter; the injected payload must be a bare subquery in the ORDER BY position, which evades the ColumnValidator control from the CVE-2024-32838 fix. Data exfiltration relies on time-based blind techniques (no direct output channel), and the denial-of-service effect additionally depends on issuing enough concurrent long-running injected queries to exhaust the configured database connection pool. Limiting factors: valid credentials plus the office-view role are mandatory (not unauthenticated), the flaw is confined to the offices orderBy parameter, and instances already upgraded to a build containing PR #6048's strict allowlist validation are not exploitable.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H, base 8.1) is internally consistent with the description: a network-reachable REST endpoint, low complexity, a low-privilege authenticated account (PR:L, matching the 'authenticated user with permission to view offices' precondition), no user interaction, high confidentiality impact from blind data exfiltration, and high availability impact from connection-pool exhaustion. Integrity is rated none because ORDER BY subquery injection supports reads/timing but not straightforward data modification. No EPSS score, KEV entry, POC reference, or SSVC decision data was provided, so probabilistic and real-world-exploitation signals cannot be weighed here - the priority rests on the CVSS profile plus the fact that this is a re-break of a previously patched issue. The most important limiting factor is the authentication requirement: this is not an unauthenticated internet-facing bug, so realistic risk is highest where many low-trust users hold office-view rights or where credentials are easily obtained. Treat as a genuine high-severity issue for exposed Fineract instances, but note the absence of any exploitation-in-the-wild evidence in the available data.

An attacker with a low-privileged Fineract account that can view offices calls GET /api/v1/offices with an orderBy value carrying a bare subquery, then measures response timing to blind-extract sensitive rows (e.g., user or client financial data) one condition at a time. Because AC:L and PR:L, exploitation is straightforward for any authorized user; firing many such requests in parallel holds database connections open for the full query duration and starves the pool, degrading or denying service for everyone else. No public POC is referenced in the available data.