# CVE-2026-35152: Apache Fineract SQL injection in runreports endpoint

Source: https://junglewise.ai/threats/cve-2026-35152-apache-fineract-sql-injection-in-runreports-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-35152 · Severity: info · CVSS 0 · Published 2026-07-15

Apache Fineract, an open-source platform for financial services, contains a security flaw in its reporting system. An authorized user with permission to run reports could use specially crafted inputs to bypass security controls and access sensitive financial data they are not supposed to see. This could lead to unauthorized data exposure and potential disruption of financial operations.

Technologies: [Apache Software Foundation Fineract](https://junglewise.ai/threats/technologies/fineract). Vendors: [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation).

## Quick answers

**Is CVE-2026-35152 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35152 being exploited in the wild.

**How severe is CVE-2026-35152?** Informational severity, with a CVSS score of 0, published 15 July 2026.

**Which products and versions are affected?** Apache Software Foundation Fineract up to and including 1.14.0.

**Is there a fix for CVE-2026-35152?** A patch was published on 2026-06-11: Fix merged in GitHub pull request #5980 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-35152 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-35152?** Check whether you run Apache Software Foundation Fineract at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the 'runreports' endpoint of Apache Fineract's Report Execution API. The root cause is the insufficient validation of report parameter values before they are incorporated into generated SQL queries. An authenticated attacker with report-running privileges can inject arbitrary SQL commands (such as UNION ALL or SLEEP) via crafted parameter values. This allows for unauthorized data extraction beyond the scope of the intended report. The issue is addressed in version 1.15.0 by implementing prepared statements and enhanced input sanitization based on type definitions.

## Affected products

- Apache Fineract up to and including 1.14.0

## Timeline

- 2026-06-11: patched: Fix merged in GitHub pull request #5980
- 2026-07-15: advisory: Public disclosure of CVE-2026-35152

## References

- [https://github.com/apache/fineract/pull/5980](https://github.com/apache/fineract/pull/5980)
- [https://lists.apache.org/thread/658yddn0bpxqw2hpxnyk3vqd05bkchg9](https://lists.apache.org/thread/658yddn0bpxqw2hpxnyk3vqd05bkchg9)
- [https://lists.apache.org/thread/d3bzcwsbywz7wg9zxvtlkvgmffqjyfn0](https://lists.apache.org/thread/d3bzcwsbywz7wg9zxvtlkvgmffqjyfn0)
- [http://www.openwall.com/lists/oss-security/2026/07/15/1](http://www.openwall.com/lists/oss-security/2026/07/15/1)

## Related threats

- [Apache Fineract SQL injection in Office Search API](https://junglewise.ai/threats/cve-2026-57821-apache-fineract-sql-injection-in-office-search-api)
- [Apache Fineract SQL injection in Client Search API](https://junglewise.ai/threats/cve-2026-56287-apache-fineract-sql-injection-in-client-search-api)