VulnSocial

CVE-2026-56287Disclosure(apache / fineract)

LOWCVSS 8.1 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch apache fineract systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/v1/clients) in versions up to and including 1.14.0. The orderBy and sortOrder request parameters are concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view clients to inject arbitrary SQL via a crafted orderBy value. This can be leveraged to perform blind boolean-based data extraction and, on MySQL/MariaDB, to disclose arbitrary files readable by the database process via the LOAD_FILE() function. Users are recommended to upgrade to a version containing the fix

apache CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Weakness type (CWE)
CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • fineract

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 4 signals
  • Disclosure: 2 classified signals
  • Peaked at 2 mentions on most recent observed day (2026-07-21)
  • 4 total mentions across 3 days

Affected systems

Vendors
apache
Products
fineract

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-07-15: 1Mentions · 2026-07-19: 1Mentions · 2026-07-21: 2Patch / Workaround · 2026-07-21: 2Technical Details · 2026-07-15: 1Technical Details · 2026-07-19: 1Technical Details · 2026-07-21: 207-1507-1907-21
Signal classification2 categories
Disclosure
250.0%
Patch
250.0%
Referenced assets6 URLs
Classification over time
DateTotalLabels
2026-07-151
Disclosure1
2026-07-191
Disclosure1
2026-07-212
Patch2
Full discourse4 posts
  • Daily CyberSecurity@Daily_CyberSec
    Patch

    Three Apache Fineract SQL injection flaws (CVE-2026-57821, CVE-2026-56287, CVE-2026-35152) let authenticated users exfiltrate data. Upgrade to 1.15.0. #ApacheFineract #SQLInjection #CVE #CoreBanking #InfoSec http://securityonline.info/apache-fineract-sql-injection/

    Post summary

    Three newly disclosed SQL injection flaws in Apache Fineract enable data exfiltration by authenticated users, and upgrading to version 1.15.0 applies the vendor’s fix.

    03040431
    12.9K followersView on X
  • Open Source Security mailing list@oss_security
    Disclosure

    Apache Fineract: 3 SQL injections CVE-2026-35152: in runreports endpoint https://www.openwall.com/lists/oss-security/2026/07/15/1 CVE-2026-56287: in Client Search API (orderBy parameter) leading to Local File Disclosure https://www.openwall.com/lists/oss-security/2026/07/15/2 CVE-2026-57821: in Office Search API https://www.openwall.com/lists/oss-security/2026/07/15/3

    Post summary

    Apache Fineract announced three vulnerabilities (CVE‑2026‑35152, CVE‑2026‑56287, CVE‑2026‑57821) involving SQL injection and local file disclosure, with no proof of concept, exploit code, active exploitation, or patch information provided.

    00051640
    4.7K followersView on X
  • kokumօtօ@__kokumoto
    Patch

    勘定系OSSのApache FineractにSQLインジェクションの脆弱性が3件。CVE-2026-57821（支店検索API）、CVE-2026-56287（職員検索API）、CVE-2026-35152（レポート実行API）。バージョン1.15.0で修正。 https://securityonline.info/apache-fineract-sql-injection/

    Post summary

    Apache Fineract contains three SQL injection flaws (CVE-2026-57821, CVE-2026-56287, CVE-2026-35152) affecting various APIs, and these issues are resolved by upgrading to version 1.15.0.

    00041870
    7.8K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-56287 A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/v1/clients) in versions up to and including 1.14.0. The orderBy an… https://www.cve.org/CVERecord?id=CVE-2026-56287

    Post summary

    The passage is a disclosure of a boolean‑based SQL injection flaw in Apache Fineract’s Client Search API, with affected versions and endpoint details but no mention of patches, PoC, or exploitation activity.

    00010646
    57.8K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appapachefineract---

Explore more

Back to dashboardapache CVEsfineract vulnerabilities