Apache Fineract Search API SQL injection fixed scope unclear (CVE-2026-64618)
Original title: CVE-2026-64618: Apache Fineract: SQL injection vulnerability in Search API
The flaw is in outStandingAmountPercentageCondition on the advanced search HTTP endpoint through version 1.15.0.
An important SQL injection affects Apache Fineract through version 1.15.0, according to a report by Terence Monteiro. Insufficient neutralization of the outStandingAmountPercentageCondition parameter on /fineract-provider/api/v1/search/advance allows SQL injection. The available text does not name a patched version or say whether the flaw is exploited.
Unconfirmed: No fixed version or exploitation status appears in the truncated post.
- Severity is listed as important.
- The affected parameter is outStandingAmountPercentageCondition.
- The endpoint is the advanced Search API.
- Versions through 1.15.0 are affected.
Impact: SQL injection through the advanced search parameter
| Product | Affected |
|---|---|
| Apache Fineract | through 1.15.0 |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-64618 | SQL injection in Apache Fineract Search API through 1.15.0 | — | — |
From the original article
Posted by Terence Monteiro on Oct 29 Severity: important Affected versions: - Apache Fineract through 1. 15. 0 Description: Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.