Severity: important
Affected versions:
- Apache Fineract through 1.15.0
Description:
Improper Neutralization of Special Elements used in an SQL Command ("SQL
Injection") vulnerability exists in Apache Fineract (through version 1.15.0).
The vulnerability affects the outStandingAmountPercentageCondition parameter of
the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL
injection due to insufficient input neutralization. Users are recommended to
upgrade to version 1.16.1, which will fix the issue.
Credit:
thiscodecc of MoyunSec Vlab and Bing (finder)
Adam Saghy (@adamsaghy) (remediation developer)
References:
https://github.com/apache/fineract/pull/6153
https://fineract.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-64618
