PT-2026-58896 · Apache · Apache Fineract

Ádám Sághy + 1 · CVE-2026-57821 · Published 2026-07-15 · Updated 2026-07-19

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache Fineract versions prior to 1.14.1

Description An authenticated user with permissions to view offices can perform a time-based blind SQL injection via the 'Office Search API' endpoint '/api/v1/offices'. The issue occurs because the orderBy request parameter is concatenated into a SQL query without sufficient validation, bypassing the ColumnValidator. This allows the injection of arbitrary SQL, which can be used for data exfiltration. Additionally, because the injected queries block database connections, concurrent exploitation may exhaust the database connection pool, leading to a denial of service.

Recommendations Upgrade to a version containing the fix. As a temporary mitigation, restrict the use of the orderBy parameter in the '/api/v1/offices' endpoint.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2026-09905

CVE-2026-57821

Affected Products

Apache Fineract

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57821.json · Exploit
• 🔥 https://github.com/tc4dy/CVE-2026-57821-PoC-Exploit · Exploit
• https://github.com/apache/fineract/pull/6048 · Patch
• https://osv.dev/vulnerability/CVE-2026-57821 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-57821 · Security Note
• https://lists.apache.org/thread/lb7zwdv7qntzy6z05gzf7m8mxw9cbgsj · Vendor Advisory
• https://lists.apache.org/thread/rj5vwh3z2xcvsf0rqwj8kokpbrxkhq4n · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-09905 · Security Note
• https://twitter.com/ptdbugs/status/2077741842284634609 · Twitter Post
• https://twitter.com/oss_security/status/2078693717867630714 · Twitter Post
• https://twitter.com/CVEnew/status/2077362443446100475 · Twitter Post