EUVD-2026-113752
GHSA-3536-74c2-mgrr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach /search/advance API endpoint
-
ExploitCraft malicious condition parameter
-
ExecutionInject SQL into ad-hoc search query
-
ImpactRead or modify Fineract database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires sending a request to the Apache Fineract advanced ad-hoc search endpoint /fineract-provider/api/v1/search/advance and supplying a crafted value in the outStandingAmountPercentageCondition parameter (the fix PR also hardened the related outstandingAmountCondition and loanDateOption parameters, which were only loosely checked); the advanced-search feature of the loan portfolio module must be reachable. Limiting factors: only versions through 1.15.0 are affected (fixed in 1.16.1), and the endpoint is part of Fineract's /api/v1 interface, which in typical deployments requires authentication - so despite the NVD PR:N rating, reaching the endpoint in a hardened deployment generally presumes valid API credentials. |
| Impact | This is a genuine SQL injection (CWE-89) in Apache Fineract's /fineract-provider/api/v1/search/advance endpoint, confirmed by the Apache oss-security advisory and the fix commit (PR #6153), which replaced a weak SqlValidator call on the outStandingAmountPercentageCondition (and related outstandingAmountCondition / loanDateOption) parameters with strict allowlist validation. The signals partly conflict: the NVD CVSS is 9.8 with AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, implying trivial unauthenticated remote exploitation, yet Fineract's /api/v1 endpoints are a core-banking API that normally sits behind authentication, so the PR:N (unauthenticated) rating should be verified against the deployment's auth configuration - if authentication is enforced, real privilege requirement is PR:L and base severity drops to ~8.8. The vuln.today decision label is act_now, which signals urgency, but EPSS is only 0.23% (14th percentile), there is no CISA KEV listing, and no public exploit was identified, so the act_now priority is driven by the critical technical impact and easy injection mechanics rather than by observed mass exploitation. Net: treat as a high-priority patch (SQLi against a financial data store with a confirmed fix) while recognizing that current real-world exploitation evidence is low and the unauthenticated rating is not independently corroborated. |
| Exploit ScenarioDerived | An attacker able to reach the advanced search API sends a request to /fineract-provider/api/v1/search/advance with a crafted outStandingAmountPercentageCondition value that breaks out of the intended comparison operator and injects SQL into the ad-hoc query. Because the old code only passed this parameter through an insufficient SqlValidator, the injected SQL executes against the Fineract database, enabling read or modification of loan and financial records. No public exploit code was identified, though the fix PR #6153 documents exactly which parameters were unneutralized. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Nov 02, 2026
SQL injection in Apache Fineract through 1.15.0 allows a caller of the /fineract-provider/api/v1/search/advance endpoint to inject arbitrary SQL through the outStandingAmountPercentageCondition parameter, giving full confidentiality and integrity impact on the Fineract database. The issue is confirmed by the Apache oss-security advisory and by upstream fix PR #6153, which removed the weak SqlValidator check and replaced it with strict allowlist validation of that condition plus the related outstandingAmountCondition and loanDateOption values. No public exploit code and no CISA KEV entry were identified at time of analysis (EPSS 0.23%, 14th percentile); NVD scores the flaw 9.8 with PR:N, while the assessed vector uses PR:L because the /api/v1 interface normally requires authentication in hardened deployments.
Earlier versions of this analysis (1)
SQL injection in Apache Fineract's advanced search API allows an attacker who can send requests to /fineract-provider/api/v1/search/advance to inject arbitrary SQL through the outStandingAmountPercentageCondition parameter, affecting all releases through 1.15.0. The assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) rates it as remote and low-complexity with high confidentiality and integrity impact, and its PR:L metric indicates the attack path uses authenticated access; the vendor advisory itself does not state the required privilege level, so the exact authentication requirement is not confirmed from the advisory alone. Apache recommends upgrading to 1.16.1; no CISA KEV listing, EPSS score, or public exploit code is present in the available data, and the vuln.today decision label is 'awaiting_data', so real-world exploitation has not been established.
RemediationAI
Vendor-released patch: upgrade to Apache Fineract 1.16.1, which contains the allowlist validation introduced in https://github.com/apache/fineract/pull/6153 and replaces the removed SqlValidator for loanDateOption, outStandingAmountPercentageCondition and outstandingAmountCondition. Confirm the build is on 1.16.1 or later and redeploy all tenants, since the fix is in application code rather than a configuration toggle. If the upgrade cannot be staged immediately, block or restrict access to /fineract-provider/api/v1/search/advance at the reverse proxy or API gateway and require authenticated, least-privileged API credentials for the ad-hoc search features; the trade-off is that advanced loan-portfolio ad-hoc search becomes unavailable to legitimate users, and any other path that forwards user-supplied condition fragments to the query builder remains unaddressed, so the upgrade is the only complete fix. Review database logs for anomalous queries against Fineract tables as a precaution, and consult the Apache advisories at https://seclists.org/oss-sec/2026/q4/440 and https://lists.apache.org/thread/s8orckszcd9x4d1qsloc046ppf5q9oc7 for the vendor's official guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Fineract is a Java/Spring-based core banking platform, and this is a classic CWE-89 SQL injection in its ad-hoc loan portfolio search path. The vulnerable code lives in SearchReadServiceImpl (fineract-provider module), where request parameters are assembled into AdHocQuerySearchConditions and used to build SQL against the Fineract database. Previously the service passed outStandingAmountPercentageCondition, outstandingAmountCondition and loanDateOption through a generic SqlValidator; that blacklist-style filtering proved insufficient, so the operator fragments (for example '=' , '>' , '<=' , 'between') could carry injected SQL into the generated query. The fix commit replaces SqlValidator entirely (it is also removed from SearchConfiguration's dependency injection) with a hardcoded allowlist: condition values are trimmed and must match one of =, >, >=, <, <= or between, loanDateOption must match the SearchConstants.SearchLoanDate enumeration, and anything else raises a PlatformApiDataValidationException carrying the message key validation.msg.search.parameter.is.not.one.of.expected.enumerations. Because the query is executed against the application's own datastore, successful injection yields read and write reach over Fineract tenant data rather than simple information disclosure.
Know when Fineract gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network SQLi with low complexity and no user interaction, but Fineract's /api/v1 endpoints normally require authentication so PR:L; SQLi grants full read/write and DoS of the backing database (C/I/A High).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2Description PRE-NVD
Executive ViewAI
A critical SQL injection vulnerability in Apache Fineract, the core banking platform, allows authenticated users to read and modify the entire database through the advance search endpoint. This affects the confidentiality and integrity of all customer financial records, loan data, and transaction history, exposing the organization to regulatory penalties, fraud risk, and severe reputational damage. Leadership should treat this as a top remediation priority given the platform's role in financial operations and the absence of a vendor patch.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to the advance search endpoint, enforce strong authentication and least-privilege roles, deploy WAF/reverse proxy filtering to block SQL metacharacters in the affected parameters, and monitor/audit endpoint access for anomalous activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Related Vulnerabilities in Apache Fineract SQL Injection Flaws
View all 2Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.8.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.8.
In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, Using a single quotation escape
SQL Injection vulnerability in various API endpoints - offices, dashboards, etc. Rated critical severity (CVSS 9.4), thi
Exposure of insufficiently protected credentials in Apache Fineract through 1.11.0 allows unauthenticated remote attacke
SQL injection in Apache Fineract's Report Execution API (the runreports endpoint) in all versions up to and including 1.
In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated user with client/loan/cent
Improper Privilege Management vulnerability in Apache Fineract.8.5. Rated high severity (CVSS 8.8), this vulnerability i
Apache Fineract allowed an authenticated user to perform remote code execution due to a path traversal vulnerability in
In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, the system exposes different RE
Weak password requirements in Apache Fineract through 1.10.1 allow attackers to more easily compromise user accounts via
Exploit-DB