CVE-2025-58137: Apache Fineract: IDOR via self-service API
Authorization Bypass Through User-Controlled Key vulnerability in Apache Fineract.
This issue affects Apache Fineract: through 1.11.0. The issue is fixed in version 1.12.1.
Users are encouraged to upgrade to version 1.13.0, the latest release.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Fineractto a version that resolves this vulnerability.Fixed in 1.12.1 - Upgrade
Upgrade
Apache Fineractto a version that resolves this vulnerability.Fixed in 1.13.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-58137?
CVE-2025-58137 is classified as a high severity vulnerability due to its potential for authorization bypass.
How do I fix CVE-2025-58137?
To fix CVE-2025-58137, upgrade Apache Fineract to version 1.12.1 or later.
What versions of Apache Fineract are affected by CVE-2025-58137?
Apache Fineract versions up to and including 1.11.0 are affected by CVE-2025-58137.
What is the nature of the vulnerability described in CVE-2025-58137?
CVE-2025-58137 is an authorization bypass vulnerability that allows user-controlled keys to bypass security controls.
Is there a safe version to use after fixing CVE-2025-58137?
Yes, after fixing CVE-2025-58137, it is safe to use version 1.13.0 of Apache Fineract.