CVE-2026-64618: Apache Fineract: SQL injection vulnerability in Search API

Published Oct 30, 2026

Updated

Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Fineract to a version that resolves this vulnerability.
Fixed in 1.16.1

Event History

Oct 30, 2026

CVE Published

via MITRE·08:29 AM

Data Sourced

via MITRE·08:29 AM

DescriptionWeakness

Data Sourced

via NVD·09:17 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are affected?

Apache Fineract deployments running version 1.15.0 or earlier are affected if the /fineract-provider/api/v1/search/advance endpoint is available.

What must an attacker be able to do to exploit this issue?

An attacker needs to be able to send requests to the advanced search API endpoint and supply a crafted outStandingAmountPercentageCondition parameter.

What should be done if the affected version is in use?

Upgrade Apache Fineract to version 1.16.1, which fixes the issue. If an immediate upgrade is not possible, restrict access to the affected advanced search endpoint as a temporary exposure-reduction measure.