Apache Fineract CVE-2026-65874

Requires an authenticated account with read access to centers or to the specific targeted datatable (the description states 'any authenticated user with read access'), so this is not anonymous/pre-auth exploitation. The exact affected endpoints are GET /api/v1/centers and the datatable read endpoints GET /api/v1/datatables/{datatable}/{apptableId} and GET /api/v1/datatables/{datatable}/{apptableId}/{datatableId}. The trigger is a caller-supplied orderBy, sortOrder, or order query parameter crafted to evade the existing regex-based validation; the vulnerable versions are Apache Fineract up to and including 1.15.0. The limiting factors are the authentication/read-authorization requirement and the blind (time-based) nature of the injection, which slows bulk extraction; upgrading to 1.16.1 removes the flaw.

This is a genuine prioritization candidate but not a drop-everything emergency, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low privileges - matching the description, which states that any authenticated user with read access to centers or to the targeted datatable can exploit it. The vuln.today decision label is 'this_week' (not act_now/emergency), which aligns with the remaining signals: EPSS is low at 0.28% (20th percentile), there is no CISA KEV listing, and no public exploit code was supplied - only the upstream fix PRs. So the high CVSS (8.8) reflects real severity for an authenticated SQL injection, but the real-world urgency is tempered by the authentication precondition, low exploitation probability, and absence of confirmed active exploitation. The one point worth flagging for analysts: the published CVSS claims full C:H/I:H/A:H, yet the described mechanism is time-based blind SQL injection in an ORDER BY clause, which typically enables data disclosure far more readily than data modification or destruction - treat the integrity/availability impact as less certain than the confidentiality impact.

An authenticated low-privilege user with read access to centers or a datatable sends a GET request to GET /api/v1/centers or GET /api/v1/datatables/{datatable}/{apptableId} with a crafted orderBy/sortOrder/order parameter that evades the regex validation and is concatenated directly into the SQL ORDER BY clause. Using time-based blind techniques (conditional delays), the attacker infers database contents character-by-character to exfiltrate sensitive financial records. No public exploit code was provided, though the fix PRs confirm the vulnerable code path.