CVE-2026-56287: Apache Fineract: Boolean SQL Injection in Client Search API (orderBy parameter) leading to Local File Disclosure
A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/v1/clients) in versions up to and including 1.14.0. The orderBy and sortOrder request parameters are concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view clients to inject arbitrary SQL via a crafted orderBy value. This can be leveraged to perform blind boolean-based data extraction and, on MySQL/MariaDB, to disclose arbitrary files readable by the database process via the LOADFILE() function. Users are recommended to upgrade to a version containing the fix
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Fineractto a version that resolves this vulnerability.Fixed in 1.14.0Patch CVE-2026-56287
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56287?
CVE-2026-56287 has a high severity score of 8.1 according to CVSS 3.1.
What is the CVE-2026-56287 vulnerability about?
CVE-2026-56287 is a boolean SQL injection vulnerability in Apache Fineract's Client Search API that can lead to local file disclosure.
Which versions of Apache Fineract are affected by CVE-2026-56287?
Apache Fineract versions up to and including 1.14.0 are affected by CVE-2026-56287.
How do I fix CVE-2026-56287?
To fix CVE-2026-56287, update Apache Fineract to a version that includes validations for the orderBy and sortOrder parameters.
What can be exploited through CVE-2026-56287?
CVE-2026-56287 can be exploited by authenticated users to execute SQL injection attacks through the Client Search API.