CVE-2026-57821: Apache Fineract: Office list: SQL Injection via Subquery in orderBy
A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET /api/v1/offices) in versions up to and including 1.14.0. The orderBy request parameter is concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view offices to inject arbitrary SQL via a crafted orderBy value. This is a bypass of the ColumnValidator fix introduced for CVE-2024-32838, which does not detect bare subqueries in the ORDER BY position. This can be leveraged to perform time-based blind SQL injection for data exfiltration. Because the injected query blocks the database connection for its full duration, concurrent exploitation can exhaust the application's database connection pool, resulting in denial of service for other users. Users are recommended to upgrade to a version containing the fix.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Fineractto a version that resolves this vulnerability.Fixed in 1.14.0Patch CVE-2026-57821 - Compensating control
Mitigate concurrent exploitation impact by restricting access to the Office Search API endpoint (GET /api/v1/offices) to authorized users only, to reduce the likelihood of SQL-injection-based database connection pool exhaustion leading to denial of service.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57821?
CVE-2026-57821 has a high severity rating of 8.1 according to the CVSS 3.1 system.
How do I fix CVE-2026-57821?
To fix CVE-2026-57821, upgrade Apache Fineract to version 1.14.1 or later, which addresses the SQL injection vulnerability.
What impact does CVE-2026-57821 have on vulnerable systems?
CVE-2026-57821 allows authenticated users to exploit SQL injection vulnerabilities, potentially leading to unauthorized data access.
Which versions of Apache Fineract are affected by CVE-2026-57821?
CVE-2026-57821 affects Apache Fineract versions up to and including 1.14.0.
Is user authentication required to exploit CVE-2026-57821?
Yes, CVE-2026-57821 requires an authenticated user with permission to access the Office Search API to exploit the vulnerability.