Vulnerability Description
A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/v1/clients) in versions up to and including 1.14.0. The orderBy and sortOrder request parameters are concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view clients to inject arbitrary SQL via a crafted orderBy value. This can be leveraged to perform blind boolean-based data extraction and, on MySQL/MariaDB, to disclose arbitrary files readable by the database process via the LOAD_FILE() function. Users are recommended to upgrade to a version containing the fix
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Fineract | < 1.15.0 |
Related Weaknesses (CWE)
References
- https://github.com/apache/fineract/pull/6020Patch
- https://lists.apache.org/thread/l5klcj2v0dx63bssvb0gmw1nzzc47colMailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/07/15/2Mailing ListThird Party Advisory
FAQ
What is CVE-2026-56287?
CVE-2026-56287 is a vulnerability with a CVSS score of 8.1 (HIGH). A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/v1/clients) in versions up to and including 1.14.0. The orderBy and sortOrder request parameters are...
How severe is CVE-2026-56287?
CVE-2026-56287 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-56287?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Fineract.