Is CVE-2026-35152 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35152 being exploited in the wild.

How severe is CVE-2026-35152?

Informational severity, with a CVSS score of 0, published 15 July 2026.

Which products and versions are affected?

Apache Software Foundation Fineract up to and including 1.14.0.

Is there a fix for CVE-2026-35152?

A patch was published on 2026-06-11: Fix merged in GitHub pull request #5980 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-35152 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-35152?

Check whether you run Apache Software Foundation Fineract at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35152: Apache Fineract SQL injection in runreports endpoint

CVE-2026-35152 · Severity: info · CVSS 0 · Published 2026-07-15

Apache Fineract, an open-source platform for financial services, contains a security flaw in its reporting system. An authorized user with permission to run reports could use specially crafted inputs to bypass security controls and access sensitive financial data they are not supposed to see. This could lead to unauthorized data exposure and potential disruption of financial operations.

Technologies: Apache Software Foundation Fineract. Vendors: Apache Software Foundation.

Quick answers

Is CVE-2026-35152 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35152 being exploited in the wild.
How severe is CVE-2026-35152?: Informational severity, with a CVSS score of 0, published 15 July 2026.
Which products and versions are affected?: Apache Software Foundation Fineract up to and including 1.14.0.
Is there a fix for CVE-2026-35152?: A patch was published on 2026-06-11: Fix merged in GitHub pull request #5980 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35152 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-35152?: Check whether you run Apache Software Foundation Fineract at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in the 'runreports' endpoint of Apache Fineract's Report Execution API. The root cause is the insufficient validation of report parameter values before they are incorporated into generated SQL queries. An authenticated attacker with report-running privileges can inject arbitrary SQL commands (such as UNION ALL or SLEEP) via crafted parameter values. This allows for unauthorized data extraction beyond the scope of the intended report. The issue is addressed in version 1.15.0 by implementing prepared statements and enhanced input sanitization based on type definitions.

Affected products

Apache Fineract up to and including 1.14.0

Timeline

2026-06-11: patched: Fix merged in GitHub pull request #5980
2026-07-15: advisory: Public disclosure of CVE-2026-35152

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.