CVE-2026-64618
Received Received - Intake

SQL Injection in Apache Fineract

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: Apache Software Foundation

Description
Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-64618
EUVD
EUVD-2026-113752

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache Fineract 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an SQL Injection vulnerability in Apache Fineract (versions up to 1.15.0). It occurs in the /fineract-provider/api/v1/search/advance endpoint due to improper neutralization of the outStandingAmountPercentageCondition parameter. Attackers can inject malicious SQL code through this parameter.

Detection Guidance

To detect this SQL injection vulnerability in Apache Fineract, monitor HTTP requests to the /fineract-provider/api/v1/search/advance endpoint. Look for unusual input in the outStandingAmountPercentageCondition parameter, such as single quotes, semicolons, or SQL keywords like UNION or SELECT. Check server logs for error messages indicating SQL syntax issues.

Impact Analysis

An attacker could exploit this to manipulate the database, steal sensitive data, modify records, or execute unauthorized commands. This could lead to data breaches, financial fraud, or system compromise depending on the database permissions.

Compliance Impact

This vulnerability could violate GDPR (data protection) and HIPAA (health data privacy) by enabling unauthorized access to sensitive personal or health information. Organizations may face legal penalties, fines, or reputational damage if exploited.

Mitigation Strategies

Immediately upgrade Apache Fineract to version 1.16.1 or later to patch the vulnerability. If upgrading is not immediately possible, restrict access to the /fineract-provider/api/v1/search/advance endpoint using network firewalls or WAF rules. Monitor for suspicious activity targeting this endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64618. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart