Apache Fineract SQL Injection Flaws Explained

What happened

Apache has identified SQL injection vulnerabilities in Apache Fineract affecting 1.15.0 and earlier. Think of a form that mistakes something written in an answer box for instructions about how to process the form. These flaws similarly let certain API inputs influence database instructions instead of remaining ordinary input.

The advisory covers CVE-2026-64618 and CVE-2026-65874. Both involve SQL injection, but they affect different inputs: a parameter in an advanced search API and ordering parameters used when reading centers or datatable entries. Apache identifies 1.16.1 and later as the fixed versions.

NVD published both entries on 2026-10-30. KISA, Korea's Internet & Security Agency, also published an advisory on 2026-11-03. Neither CVE is listed in CISA's Known Exploited Vulnerabilities catalog, commonly called KEV, as of the check date; that catalog status should not replace checking whether an installation needs an update.

Technical details

Both vulnerabilities are classified as CWE-89, the weakness category for SQL injection caused by inadequate handling of special elements in SQL commands. SQL is the language applications use to query databases. Injection happens when caller-controlled input can change the meaning of a database command instead of being handled only as an intended value or permitted option.

CVE-2026-64618 affects the outStandingAmountPercentageCondition parameter in Apache Fineract's advanced search HTTP API. The underlying problem is insufficient neutralization of that input before it reaches a SQL command. The description does not specify authentication requirements, so developers and administrators should not assume that it has the same access prerequisites as the other vulnerability.

CVE-2026-65874 affects reads of centers and datatable entries. The application joins caller-supplied orderBy, sortOrder, and order inputs directly into an ORDER BY clause, which controls how query results are sorted. Its regular-expression checks can be bypassed. An authenticated user with read access to centers or the targeted datatable can perform time-based blind SQL injection: database response timing can provide clues about a query even when its results are not directly displayed.

NVD assigns CVE-2026-64618 a CVSS 3.1 score of 9.8 with CRITICAL severity, and CVE-2026-65874 a CVSS 3.1 score of 8.8 with HIGH severity. CVSS, the Common Vulnerability Scoring System, describes technical severity. These scores help prioritize remediation, but they are not measurements of how often attacks occur or proof that a particular deployment has been compromised.

Weakness types: SQL injection

Who is affected

Everyday users

For everyday users, the relevant question is whether a service they use runs an affected Apache Fineract installation. The update belongs with the team operating that service. Changing a browser preference or installing a local browser update does not repair how the server builds database queries.

The descriptions establish weaknesses in database query handling, but they do not establish that a particular person's information was accessed or changed. If your service provider uses Apache Fineract, ask whether it has completed the upgrade to 1.16.1 or later.

Developers

Developers maintaining Apache Fineract integrations should identify code that calls advanced search or supplies ordering options for center and datatable reads. These are the specific request surfaces described in the advisory. For CVE-2026-65874, an account's read access is enough to satisfy the stated permission requirement; read-only application permissions should not be treated as protection against this flaw.

The root causes also illustrate why checking whether input looks acceptable is different from keeping it safely separated from SQL syntax. In the ordering flaw, the existing regular-expression validation could be bypassed. Updating the affected Apache Fineract installation is the prescribed fix; client-side checks alone do not establish that the server-side vulnerability has been corrected.

Server and IT admins

Server and IT administrators should determine which Apache Fineract installations run 1.15.0 or earlier and plan their upgrade to 1.16.1 or later. Include installations serving internal users: the ordering vulnerability explicitly involves authenticated users who already have relevant read access.

The different severity ratings are useful for prioritization, but the documented upgrade addresses both vulnerabilities. Treat the work as an Apache Fineract release update and verification task, with attention to the advanced search, center-read, and datatable-read functions described in the advisory.

What to do now

1. Inventory your Apache Fineract installations and determine their running versions. Flag installations on 1.15.0 and earlier as affected.
2. Review Apache's advisory for the update requirements and the affected functions. Identify the people responsible for the application, its integrations, and deployment.
3. Prepare the upgrade to 1.16.1 or later and follow the update steps in the vendor's advisory.
4. Include advanced search, center reads, and datatable entry reads in your normal functional checks so the update is assessed against the features involved.
5. After deployment, confirm the version actually running in each installation. A downloaded release or a completed preparation task does not establish that the running application has been updated.
6. Record the deployed version and verification results against both CVE-2026-64618 and CVE-2026-65874 so neither issue is left unresolved in your tracking.

If you can't update yet

• Check the vendor advisory for guidance on restricting access to affected APIs while the upgrade is pending. Review which users and systems need access to advanced search, centers, and datatable reads.
• Check the vendor advisory for guidance on reducing internet exposure while you arrange the update. Treat access restrictions as temporary risk reduction, not confirmation that the SQL injection flaws are fixed.

How to confirm the fix

• Confirm that each running Apache Fineract installation reports 1.16.1 or later, rather than relying only on the version selected for deployment.
• Follow any fix-verification guidance in the vendor's advisory and check that the upgrade completed successfully.
• Confirm that legitimate advanced search requests and authorized center and datatable reads still work as expected. Functional success supports deployment validation, but does not by itself prove that SQL injection is prevented.
• Check your installation inventory again and resolve any remaining entries running 1.15.0 or earlier.

NVD scores and CISA KEV status

As of November 3, 2026, none of these CVEs is listed in the CISA Known Exploited Vulnerabilities catalog.

Affected products and fixed versions 2 rows

The vendor's advisory is the authority on affected and fixed versions. If a cell says “See the vendor advisory”, check it there.

Frequently asked questions

References

• Apache advisory: https://lists.apache.org/thread/s8orckszcd9x4d1qsloc046ppf5q9oc7
• Apache advisory: https://lists.apache.org/thread/c4q539mkm5blnp5vdb72tzq6r9qg7bdh
• NVD: CVE-2026-64618
• NVD: CVE-2026-65874
• CISA Known Exploited Vulnerabilities catalog
• Also reported by KISA (Korea Internet & Security Agency) on November 3, 2026: KISA advisory (Korean)

How this page is made: versions and CVE IDs come from the vendor advisory table; CVSS scores and weakness types from NVD; exploitation status only from CISA KEV. The explainer is written with AI from those facts and published only after an automated check matches every version, CVE, score and command against the sources. Commands are limited to ones in official documentation. Always follow the vendor's advisory. Read in Korean.