What is the CVSS score of CVE-2026-57821?

CVE-2026-57821 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Apache Fineract are affected by CVE-2026-57821?

Apache Fineract versions 1.14.0 and earlier contain a SQL injection vulnerability in the Office Search API that allows authenticated users with office-view permissions to exfiltrate sensitive…

How to fix or mitigate CVE-2026-57821?

Within 24 hours: enumerate all Fineract deployments and their versions, audit which users hold office-view permissions, and enable detailed query logging for the Office Search API endpoint. Within 7 days: implement compensating controls including Web Application Firewall rules to block SQL injection attempts in the orderBy parameter, restrict database connection pool size to constrain DoS impact, and minimize office-view permission assignments to essential administrators only. Within 30 days: monitor the apache/fineract repository for release of a patched version addressing this vulnerability, conduct functional testing in non-production environments, and execute a phased production deployment once a fix becomes available.

Apache Fineract CVE-2026-57821

EUVD-2026-44605 HIGH

SQL Injection (CWE-89)

2026-07-15

GHSA-wq49-6h5f-gc65

SQLi Apache Microsoft Denial Of Service Fineract

8.1

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

8.1 HIGH

Network REST endpoint (AV:N/AC:L), requires a low-priv office-view account (PR:L), blind read yields C:H with no write path (I:N), and connection-pool exhaustion gives A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 13:29 vuln.today

Analysis Updated

Jul 15, 2026 - 13:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 15, 2026 - 13:22 vuln.today

cvss_changed

CVSS changed

Jul 15, 2026 - 13:22 NVD

8.1 (HIGH)

Analysis Generated

Jul 15, 2026 - 08:16 vuln.today

CVE Published

Jul 15, 2026 - 06:42 oss-security

HIGH

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News 9 New Apache Vulnerabilities - 9 High Severity, No Public Exploits Jul 16, 2026

AnalysisAI

SQL injection in Apache Fineract's Office Search API (GET /api/v1/offices) in all versions up to and including 1.14.0 lets an authenticated user who holds the office-view permission inject arbitrary SQL through the orderBy request parameter. Because it bypasses the ColumnValidator hardening added for CVE-2024-32838, an attacker can run time-based blind SQL injection to exfiltrate database contents and, by launching concurrent injections that hold connections open, exhaust the database connection pool to cause denial of service. No public exploit identified at time of analysis; the flaw is documented via an oss-security advisory and an upstream fix pull request (apache/fineract #6048).

Technical ContextAI

Apache Fineract is an open-source core-banking / financial-services platform (the codebase behind many microfinance and digital-banking deployments) built on Java/Spring with a relational back end accessed via JdbcTemplate. The vulnerable code path is OfficeReadPlatformServiceImpl.retrieveAllOffices, which concatenated the user-supplied orderBy value directly into the ORDER BY clause of a hand-built SQL string. This is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) defect. The prior CVE-2024-32838 fix relied on ColumnValidator.validateSqlInjection, but that validator does not detect bare subqueries placed in the ORDER BY position, so a payload embedding a subquery in ORDER BY slips through. The PR #6048 diff replaces ColumnValidator with a profile-driven InputValidator that enforces a strict allowlist regex (^(id|name(Decorated)?|externalId|hierarchy|openingDate)$) for the office orderBy column and restricts sortOrder to exactly ASC or DESC.

RemediationAI

Upstream fix available (PR/commit) via https://github.com/apache/fineract/pull/6048; a released patched version is not independently confirmed from the provided data, so upgrade to the first tagged Fineract release that incorporates PR #6048 (the vendor recommends upgrading to a version containing the fix - monitor https://fineract.apache.org/ and the Apache threads at https://lists.apache.org/thread/lb7zwdv7qntzy6z05gzf7m8mxw9cbgsj and https://lists.apache.org/thread/rj5vwh3z2xcvsf0rqwj8kokpbrxkhq4n for the exact version). Until patched, apply the fix's logic as a compensating control: enforce a strict allowlist on the orderBy parameter for /api/v1/offices (only id, name, nameDecorated, externalId, hierarchy, openingDate) and restrict sortOrder to ASC/DESC at a WAF or API gateway, rejecting any orderBy value containing parentheses, whitespace, or SQL keywords - the side effect is that clients using non-standard sort columns will break. Additionally, tighten who holds the office-view permission to shrink the pool of accounts that can reach the endpoint, and cap or time-out database connections and per-user query concurrency to blunt the connection-pool-exhaustion DoS (trade-off: legitimate long-running queries may be terminated). Do not rely on the older ColumnValidator, which is the very control this vulnerability bypasses.