CVE-2026-56287 Details
Description
A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/v1/clients) in versions up to and including 1.14.0. The orderBy and sortOrder request parameters are concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view clients to inject arbitrary SQL via a crafted orderBy value. This can be leveraged to perform blind boolean-based data extraction and, on MySQL/MariaDB, to disclose arbitrary files readable by the database process via the LOAD_FILE() function. Users are recommended to upgrade to a version containing the fix
A boolean-based SQL injection vulnerability has been identified in Apache Fineract's Client Search API (GET /api/v1/clients) in versions prior to and including 1.14.0. The vulnerability arises because the orderBy and sortOrder request parameters are added to a SQL query without adequate validation. This flaw allows an authenticated user with permission to view clients to inject arbitrary SQL by manipulating the orderBy parameter. Exploitation of this vulnerability could lead to blind boolean-based data extraction and, in MySQL/MariaDB environments, unauthorized disclosure of files accessible by the database process through the LOAD_FILE() function.
Users are advised to upgrade to Apache Fineract version 1.15.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/07/15/2 | CVE | Mailing ListThird Party Advisory |
| https://github.com/apache/fineract/pull/6020 | [email protected] | Patch |
| https://lists.apache.org/thread/l5klcj2v0dx63bssvb0gmw1nzzc47col | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache fineract | < 1.15.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | Initial Analysis | [email protected] |
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |
| Jul 15, 2026 | CVE Modified | CVE |