CVE-2026-65874: Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints
This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint (GET /api/v1/centers) and the datatable entry read endpoints (GET /api/v1/datatables/{datatable}/{apptableId} and GET /api/v1/datatables/{datatable}/{apptableId}/{datatableId}) concatenate caller-supplied ordering parameters (orderBy, sortOrder, order) directly into the SQL ORDER BY clause. The existing regex-based input validation can be bypassed, allowing time-based blind SQL injection by any authenticated user with read access to centers or to the targeted datatable.
Users are recommended to upgrade to 1.16.1 which fixes the issue.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Fineractto a version that resolves this vulnerability.Fixed in 1.16.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have read access to the Centers endpoint or to the specific datatable being queried. The issue is therefore exposed to users whose assigned permissions allow those reads.
Which requests and parameters should be reviewed for exploitation attempts?
Review requests to GET /api/v1/centers and the listed datatable entry read endpoints for attacker-controlled ordering parameters: orderBy, sortOrder, and order. The documented impact is time-based blind SQL injection through values incorporated into SQL ORDER BY clauses.
What should be done if affected versions are in use?
Upgrade Apache Fineract to version 1.16.1, which fixes the issue. Until upgrading, restrict read permissions for centers and sensitive datatables to only trusted authenticated users.