CVE-2026-65874: Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints

As cited

Copy frozen at 2026-10-30 04:39 UTC (site build).

vulnerabilities

CVE-2026-65874: Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints

Apache Fineract versions through 1.15.0 contain a SQL injection vulnerability in the Center and datatable read endpoints that stems from unsafe concatenation of caller-supplied ordering parameters. The vulnerability affects the GET endpoints for centers and datatable entries, where orderBy, sortOrder, and order parameters are directly incorporated into SQL queries without proper sanitization.

Why it matters: Administrators and developers using Fineract to manage financial operations need to patch to a version after 1.15.0 immediately, as attackers can exploit these endpoints to execute arbitrary SQL commands and potentially access, modify, or delete sensitive financial data.

Source published

2026-10-30 03:00 UTC

First seen by Cybersecurity Tracker

2026-10-30 04:01 UTC