CVE-2026-35152General(apache / fineract)

LOWCVSS 8.8 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch apache fineract systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to and including 1.14.0. Report parameter values are incorporated into the generated SQL query without sufficient validation, allowing an authenticated user with permission to run reports to inject arbitrary SQL via crafted parameter values. This can be leveraged to perform unauthorized access to data beyond what the report was designed to expose. Users are recommended to upgrade to a version containing the fix.

apache CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/apache/fineract/pull/5980

Vendor / third-party advisories

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

fineract

Threat summary

Patch or workaround signal is available
7 mentions across 5 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 7 signals
General: 4 classified signals
Disclosure: 1 classified signal
Peaked 2d ago at 2 mentions (2026-07-19); latest day: 2
7 total mentions across 5 days

Affected systems

Vendors

apache

Products

fineract

Deep dive

Activity timeline7 mentions / 5d

Signal classification3 categories

General

457.1%

Patch

228.6%

Disclosure

114.3%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-15	1	General1
2026-07-18	1	General1
2026-07-19	2	Disclosure1General1
2026-07-20	1	General1
2026-07-21	2	Patch2

Full discourse7 posts

Daily CyberSecurity@Daily_CyberSec85d
Patch
Three Apache Fineract SQL injection flaws (CVE-2026-57821, CVE-2026-56287, CVE-2026-35152) let authenticated users exfiltrate data. Upgrade to 1.15.0. #ApacheFineract #SQLInjection #CVE #CoreBanking #InfoSec http://securityonline.info/apache-fineract-sql-injection/
Post summary
The message warns about three SQL injection flaws in Apache Fineract that let authenticated users exfiltrate data and recommends immediately upgrading to version 1.15.0 to remediate the issue.
03040431
12.9K followersView on X
Open Source Security mailing list@oss_security88d
Disclosure
Apache Fineract: 3 SQL injections CVE-2026-35152: in runreports endpoint https://www.openwall.com/lists/oss-security/2026/07/15/1 CVE-2026-56287: in Client Search API (orderBy parameter) leading to Local File Disclosure https://www.openwall.com/lists/oss-security/2026/07/15/2 CVE-2026-57821: in Office Search API https://www.openwall.com/lists/oss-security/2026/07/15/3
Post summary
Apache Fineract is affected by three newly disclosed vulnerabilities (SQL injections in the runreports and Office Search APIs, and local file disclosure via the Client Search API). No proof‑of‑concept, exploit code, or patch is mentioned, nor is there evidence of active exploitation.
00051640
4.7K followersView on X
kokumօtօ@__kokumoto85d
Patch
勘定系OSSのApache FineractにSQLインジェクションの脆弱性が3件。CVE-2026-57821（支店検索API）、CVE-2026-56287（職員検索API）、CVE-2026-35152（レポート実行API）。バージョン1.15.0で修正。 https://securityonline.info/apache-fineract-sql-injection/
Post summary
The post announces three SQL injection CVEs in Apache Fineract, details the affected APIs, and states that the issue is fixed in version 1.15.0.
00041870
7.8K followersView on X
ゆぅさん@YY2042427786d
General
【3軸解説】「Apache Software FoundationのApache FineractにおけるSQL インジェクションの脆弱性（CVE-2026-35152）」を、背景 / 目的 / 効果の 3 軸で読み解きます。背景/目的/効果の3軸で読み解きました。 #セキュリティ #若手コンサル ▶ 無料ツール WR-Analysis: https://www.intect-i.jp/tools/wr-analysis/?utm_source=sns&utm_medium=social&utm_campaign=wr_analysis
Post summary
The post gives a three-axis contextual analysis (background, purpose, effect) of CVE-2026-35152, an SQL injection flaw in Apache Fineract, but it does not provide PoC, exploit code, active usage, or patch details.
0000072
843 followersView on X
ゆぅさん@YY2042427788d
General
【3軸解説】「Apache Software FoundationのApache FineractにおけるSQL インジェクションの脆弱性（CVE-2026-35152）」を、背景 / 目的 / 効果の 3 軸で読み解きます。背景/目的/効果の3軸で読み解きました。 #セキュリティ #若手コンサル ▶ 無料ツール WR-Analysis: https://www.intect-i.jp/tools/wr-analysis/?utm_source=sns&utm_medium=social&utm_campaign=wr_analysis
Post summary
The post offers a conceptual framework for understanding CVE-2026-35152 (an SQL injection issue in Apache Fineract) but does not provide technical exploitation details, PoC, or mitigation steps.
0000061
842 followersView on X
ゆぅさん@YY2042427788d
General
【3軸解説】「Apache Software FoundationのApache FineractにおけるSQL インジェクションの脆弱性（CVE-2026-35152）」を、背景 / 目的 / 効果の 3 軸で読み解きます。背景/目的/効果の3軸で読み解きました。 #セキュリティ #若手コンサル ▶ 無料ツール WR-Analysis: https://www.intect-i.jp/tools/wr-analysis/?utm_source=sns&utm_medium=social&utm_campaign=wr_analysis
Post summary
An analytical article outlining the background, purpose, and impact of the CVE-2026-35152 SQL injection in Apache Fineract, without providing PoC, exploit, patch, or active exploitation details.
0000068
842 followersView on X
CVE@CVEnew91d
General
CVE-2026-35152 A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to and including 1.14.0. Report parameter values a… https://www.cve.org/CVERecord?id=CVE-2026-35152
Post summary
The post alerts that CVE-2026-35152 is a SQL injection in Apache Fineract’s report API, but provides no proof‑of‑concept, exploit code, exploitation data, or patch information.
00000610
57.8K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	fineract	-	-	-

Explore more

Back to dashboard apache CVEs fineract vulnerabilities

What researchers are saying

CVE-2026-35152

kokumօtօ[verified]@__kokumotoPatch

The post announces three SQL injection CVEs in Apache Fineract, details the affected APIs, and states that the issue is fixed in version 1.15.0.

ゆぅさん[verified]@YY20424277General

The post gives a three-axis contextual analysis (background, purpose, effect) of CVE-2026-35152, an SQL injection flaw in Apache Fineract, but it does not provide PoC, exploit code, active usage, or patch details.

ゆぅさん[verified]@YY20424277General

The post offers a conceptual framework for understanding CVE-2026-35152 (an SQL injection issue in Apache Fineract) but does not provide technical exploitation details, PoC, or mitigation steps.

ゆぅさん[verified]@YY20424277General

An analytical article outlining the background, purpose, and impact of the CVE-2026-35152 SQL injection in Apache Fineract, without providing PoC, exploit, patch, or active exploitation details.

Daily CyberSecurity@Daily_CyberSecPatch

The message warns about three SQL injection flaws in Apache Fineract that let authenticated users exfiltrate data and recommends immediately upgrading to version 1.15.0 to remediate the issue.

Open Source Security mailing list@oss_securityDisclosure

Apache Fineract is affected by three newly disclosed vulnerabilities (SQL injections in the runreports and Office Search APIs, and local file disclosure via the Client Search API). No proof‑of‑concept, exploit code, or patch is mentioned, nor is there evidence of active exploitation.

CVE@CVEnewGeneral

The post alerts that CVE-2026-35152 is a SQL injection in Apache Fineract’s report API, but provides no proof‑of‑concept, exploit code, exploitation data, or patch information.