Executive brief
Apache Fineract, an open-source platform for financial services, contains a security flaw in its reporting system. An authorized user with permission to run reports could use specially crafted inputs to bypass security controls and access sensitive financial data they are not supposed to see. This could lead to unauthorized data exposure and potential disruption of financial operations.
Technical details
A SQL injection vulnerability exists in the 'runreports' endpoint of Apache Fineract's Report Execution API. The root cause is the insufficient validation of report parameter values before they are incorporated into generated SQL queries. An authenticated attacker with report-running privileges can inject arbitrary SQL commands (such as UNION ALL or SLEEP) via crafted parameter values. This allows for unauthorized data extraction beyond the scope of the intended report. The issue is addressed in version 1.15.0 by implementing prepared statements and enhanced input sanitization based on type definitions.
Affected products
- Apache Fineract up to and including 1.14.0
Timeline
- 2026-06-11: patched: Fix merged in GitHub pull request #5980
- 2026-07-15: advisory: Public disclosure of CVE-2026-35152