SZB-c7ec61c5f1
Apache Fineract discloses SQL injection flaw in Search API (CVE-2026-64618)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Apache Fineract
- Product
- Apache Fineract Search API
- First seen
Summary
An oss-security post by Terence Monteiro describes a SQL injection vulnerability in the outStandingAmountPercentageCondition parameter of Apache Fineract's /search/advance API endpoint. The post rates it 'important' and says versions through 1.15.0 are affected.
If you use Apache Fineract
Check the Apache Fineract advisory for the fixed release and upgrade beyond 1.15.0
Restrict access to the /fineract-provider/api/v1/search/advance endpoint until patched
Review logs for anomalous queries against the search endpoint
What the sources say 1
· oss-security: “CVE-2026-64618: Apache Fineract: SQL injection vulnerability in Search API” Source