Apache Fineract through 1.15.0 has SQL injection in ORDER BY (CVE-2026-65874)
Original title: CVE-2026-65874: Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints
Caller-supplied orderBy, sortOrder and related parameters are concatenated on Center and datatable read APIs.
Terence Monteiro reported an important SQL injection in Apache Fineract through 1.15.0. The Center read endpoint and datatable entry read endpoints concatenate caller-supplied ordering parameters, including orderBy and sortOrder. The posted description is truncated and does not state a fixed release or exploitation.
Unconfirmed: The snippet is cut off and does not state a fix or exploitation status.
- Severity is rated important.
- GET /api/v1/centers is affected.
- Two datatable entry read GET routes are affected.
- Affected range is through 1.15.0.
Impact: SQL injection through ordering parameters on read APIs
| Product | Affected |
|---|---|
| Apache Fineract | through 1.15.0 |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-65874 | Authenticated SQL injection in Apache Fineract through 1.15.0 | — | — |
From the original article
Posted by Terence Monteiro on Oct 29 Severity: important Affected versions: - Apache Fineract through 1. 15. 0 Description: This issue affects Apache Fineract versions up to and including 1.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.