{"id":"CVE-2026-65874","aliases":[],"cve":{"records":[{"id":"CVE-2026-65874","source":"apache","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-23T05:21:34.024Z","published":"2026-10-30T08:18:08.619Z","modified":"2026-10-30T09:10:29.643Z"}],"publishers":[{"name":"apache","role":"CNA","organizationId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","modified":"2026-10-30T08:18:08.619Z"},{"name":"CVE","role":"ADP","organizationId":"af854a3a-2127-422b-91ae-364da2661108","modified":"2026-10-30T09:10:29.643Z"}],"references":[{"url":"https://github.com/apache/fineract/pull/6230","tags":["patch"],"source":"apache"},{"url":"https://github.com/apache/fineract/pull/6277","tags":["patch"],"source":"apache"},{"url":"https://lists.apache.org/thread/c4q539mkm5blnp5vdb72tzq6r9qg7bdh","tags":["vendor-advisory"],"source":"apache"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/30/5","tags":[],"source":"CVE"}],"weaknesses":[{"id":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","source":"apache"}],"applicability":[],"prioritization":[]},"title":"Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints","titleSource":"apache","descriptionSource":"apache","description":"This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint (GET /api/v1/centers) and the datatable entry read endpoints (GET /api/v1/datatables/{datatable}/{apptableId} and GET /api/v1/datatables/{datatable}/{apptableId}/{datatableId}) concatenate caller-supplied ordering parameters (orderBy, sortOrder, order) directly into the SQL ORDER BY clause. The existing regex-based input validation can be bypassed, allowing time-based blind SQL injection by any authenticated user with read access to centers or to the targeted datatable.\n\nUsers are recommended to upgrade to 1.16.1 which fixes the issue.","score":null,"severity":"unknown","published":"2026-10-30T08:18:08.619Z","modified":"2026-10-30T09:10:29.643Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Apache Software Foundation","name":"Apache Fineract","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.15.0","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-65874"}],"remediation":[],"references":["https://github.com/apache/fineract/pull/6230","https://github.com/apache/fineract/pull/6277","https://lists.apache.org/thread/c4q539mkm5blnp5vdb72tzq6r9qg7bdh","http://www.openwall.com/lists/oss-security/2026/10/30/5"],"sources":[{"name":"CVE","id":"CVE-2026-65874","modified":"2026-10-30T09:10:29.643Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-65874"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-10-30T09:31:08.759Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:00:31.626Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-30T08:30:40.477Z","attemptedAt":"2026-10-30T08:30:40.477Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T08:30:40.708Z","attemptedAt":"2026-10-30T08:30:40.708Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-10-30T08:30:40.831Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T08:30:41.125Z","attemptedAt":"2026-10-30T08:30:41.125Z"}],"evidence":[],"aiSummary":{"text":"Apache Fineract versions up to 1.15.0 are affected by SQL injection via ORDER BY parameters. Any authenticated user with read access can bypass input validation, allowing time-based blind SQL injection. Impact is uncertain.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T08:31:26.429Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-65874"}]}}