Apache Fineract through 1.15.0 has two important SQL injection flaws

1 source · 2 articlesFirst reported Oct 30, 2026 · 02:58 UTCUpdated Oct 30, 2026 · 03:00 UTC (23h ago)1

What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Two important SQL injection bugs affect Apache Fineract through 1.15.0; no fix or exploitation status is stated.

Terence Monteiro reported two important SQL injection vulnerabilities in Apache Fineract through version 1.15.0. CVE-2026-64618 is insufficient neutralization of outStandingAmountPercentageCondition on the advanced search endpoint /fineract-provider/api/v1/search/advance. CVE-2026-65874 is concatenation of caller-supplied ordering parameters, including orderBy and sortOrder, on the Center read endpoint GET /api/v1/centers and two datatable entry read GET routes. The posted descriptions do not name a patched release or say whether either flaw is exploited.

Key facts

CVE-2026-64618 affects outStandingAmountPercentageCondition on the advanced Search API.
CVE-2026-65874 affects orderBy and sortOrder on Center and datatable reads.
Both flaws are rated important and affect versions through 1.15.0.
GET /api/v1/centers and two datatable entry read routes are affected.
Reports name no fixed release and do not state exploitation.

Analyze CVE-2026-65874 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first

Oct 30, 2026CVE-2026-64618 advanced-search SQL injection disclosed · oss-security
Oct 30, 2026CVE-2026-65874 ordering-parameter SQL injection disclosed · oss-security

What each outlet adds

beyond the shared facts

oss-securityNames both CVEs, endpoints, parameters, and the through-1.15.0 range.

CVEs: CVE-2026-65874 CVE-2026-64618

Vendors: Apache
Products: Apache Fineract

Coverage

oldest first · one row per article · UTC

Oct 30, 02:58 UTC · 23h ago oss-securityFirst report
Apache Fineract Search API SQL injection fixed scope unclear (CVE-2026-64618)
The flaw is in outStandingAmountPercentageCondition on the advanced search HTTP endpoint through version 1.15.0.
Oct 30, 03:00 UTC · 23h ago oss-security
Apache Fineract through 1.15.0 has SQL injection in ORDER BY (CVE-2026-65874)
Caller-supplied orderBy, sortOrder and related parameters are concatenated on Center and datatable read APIs.

Vulnerabilities in this story

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-64618 +1 related CVE CVE-2026-65874	SQL injection in Apache Fineract Search API through 1.15.0	—	—		16h ago