SQLi in Apache Fineract <=1.15.0 via GET orderBy param
CVE-2026-65874 Published on October 30, 2026
Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints
This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint (GET /api/v1/centers) and the datatable entry read endpoints (GET /api/v1/datatables/{datatable}/{apptableId} and GET /api/v1/datatables/{datatable}/{apptableId}/{datatableId}) concatenate caller-supplied ordering parameters (orderBy, sortOrder, order) directly into the SQL ORDER BY clause. The existing regex-based input validation can be bypassed, allowing time-based blind SQL injection by any authenticated user with read access to centers or to the targeted datatable.
Users are recommended to upgrade to 1.16.1 which fixes the issue.
Weakness Type
What is a SQL Injection Vulnerability?
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.
CVE-2026-65874 has been classified to as a SQL Injection vulnerability or weakness.
Products Associated with CVE-2026-65874
Want to know whenever a new CVE is published for Apache Fineract? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache Fineract:- Before and including 1.15.0 is affected.