# CVE-2026-57821: Apache Fineract SQL injection in Office Search API

Source: https://junglewise.ai/threats/cve-2026-57821-apache-fineract-sql-injection-in-office-search-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-57821 · Severity: info · CVSS 0 · Published 2026-07-15

Apache Fineract, an open-source platform for financial services, contains a security flaw in its office search functionality. An authorized user could potentially run unauthorized database commands, which may lead to the theft of sensitive financial data or cause the system to become unresponsive for all users. Organizations using Fineract should upgrade to version 1.15.0 or later to resolve this issue.

Technologies: [Apache Software Foundation Fineract](https://junglewise.ai/threats/technologies/fineract). Vendors: [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation).

## Quick answers

**Is CVE-2026-57821 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57821 being exploited in the wild.

**How severe is CVE-2026-57821?** Informational severity, with a CVSS score of 0, published 15 July 2026.

**Which products and versions are affected?** Apache Software Foundation Fineract <= 1.14.0.

**Is there a fix for CVE-2026-57821?** A patch was published on 2026-06-27: Pull request for fix submitted to GitHub Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57821 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-57821?** Check whether you run Apache Software Foundation Fineract at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the Apache Fineract Office Search API (GET /api/v1/offices) due to improper validation of the 'orderBy' request parameter. The parameter is concatenated directly into SQL queries, bypassing a previous fix (CVE-2024-32838) because the ColumnValidator failed to detect subqueries in the ORDER BY clause. An authenticated attacker with office-viewing permissions can perform time-based blind SQL injection to exfiltrate data. Additionally, concurrent exploitation can exhaust the database connection pool, leading to a denial of service (DoS). The issue is fixed in version 1.15.0 by implementing a strict allowlist for the 'orderBy' parameter.

## Affected products

- Apache Software Foundation Fineract <= 1.14.0

## Timeline

- 2026-06-27: patched: Pull request for fix submitted to GitHub
- 2026-06-29: other: Fix merged into develop branch
- 2026-07-15: advisory: CVE published by NVD

## References

- [https://github.com/apache/fineract/pull/6048](https://github.com/apache/fineract/pull/6048)
- [https://lists.apache.org/thread/lb7zwdv7qntzy6z05gzf7m8mxw9cbgsj](https://lists.apache.org/thread/lb7zwdv7qntzy6z05gzf7m8mxw9cbgsj)
- [https://lists.apache.org/thread/rj5vwh3z2xcvsf0rqwj8kokpbrxkhq4n](https://lists.apache.org/thread/rj5vwh3z2xcvsf0rqwj8kokpbrxkhq4n)

## Related threats

- [Apache Fineract SQL injection in Client Search API](https://junglewise.ai/threats/cve-2026-56287-apache-fineract-sql-injection-in-client-search-api)
- [Apache Fineract SQL injection in runreports endpoint](https://junglewise.ai/threats/cve-2026-35152-apache-fineract-sql-injection-in-runreports-endpoint)