CVE-2026-57821 Details
Description
A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET /api/v1/offices) in versions up to and including 1.14.0. The orderBy request parameter is concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view offices to inject arbitrary SQL via a crafted orderBy value. This is a bypass of the ColumnValidator fix introduced for CVE-2024-32838, which does not detect bare subqueries in the ORDER BY position. This can be leveraged to perform time-based blind SQL injection for data exfiltration. Because the injected query blocks the database connection for its full duration, concurrent exploitation can exhaust the application's database connection pool, resulting in denial of service for other users. Users are recommended to upgrade to a version containing the fix.
A SQL injection vulnerability has been identified in Apache Fineract's Office Search API (GET /api/v1/offices) in versions prior to and including 1.14.0. The vulnerability arises because the orderBy request parameter is added to a SQL query without adequate validation. This flaw allows an authenticated user with permission to view offices to inject arbitrary SQL by manipulating the orderBy value. This issue circumvents the ColumnValidator fix implemented for CVE-2024-32838, which fails to detect bare subqueries in the ORDER BY clause. Exploitation of this vulnerability can lead to time-based blind SQL injection, allowing for data exfiltration. Additionally, because the injected SQL query monopolizes the database connection for its entire execution time, simultaneous exploitation can deplete the application's database connection pool, causing a denial-of-service condition for other users.
Users are advised to upgrade to Apache Fineract version 1.15.0 or later, which addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/apache/fineract/pull/6048 | [email protected] | Patch |
| https://lists.apache.org/thread/lb7zwdv7qntzy6z05gzf7m8mxw9cbgsj | [email protected] | Mailing ListVendor Advisory |
| https://lists.apache.org/thread/rj5vwh3z2xcvsf0rqwj8kokpbrxkhq4n | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache fineract | < 1.15.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | Initial Analysis | [email protected] |
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |