Apache Fineract Search API SQL injection fixed scope unclear (CVE-2026-64618)
The flaw is in outStandingAmountPercentageCondition on the advanced search HTTP endpoint through version 1.15.0.
52
Vulnerability1 · 1 read
CVE-2026-64618
SQL injection in Apache Fineract Search API through 1.15.0
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Fineract through 1.15.0 does not neutralize the outStandingAmountPercentageCondition parameter on the /fineract-provider/api/v1/search/advance HTTP endpoint, so crafted input is interpreted as SQL. Anyone who can call that search API can inject SQL and read or change data the database account can reach. Deployments running 1.15.0 or earlier are affected.
What to do: Upgrade Apache Fineract to 1.16.1, which fixes this SQL injection.
| Product | Affected | Fixed in |
|---|---|---|
| Apache Fineract | through 1.15.0 | 1.16.1 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue.
- Weakness
- CWE-89