High severity · published Jul 15, 2026
CVE-2026-35152
Apache Fineract: SQL injection in runreports endpoint
8.8
CVSS
3.3%
EPSS
No
On KEV
Description
A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to and including 1.14.0. Report parameter values are incorporated into the generated SQL query without sufficient validation, allowing an authenticated user with permission to run reports to inject arbitrary SQL via crafted parameter values. This can be leveraged to perform unauthorized access to data beyond what the report was designed to expose. Users are recommended to upgrade to a version containing the fix.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.3% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Apache Fineract · Apache Software Foundation
through 1.14.0 · source: vendor
FI
Fineract · Apache
before 1.15.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-35152
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-35152
Patch
https://github.com/apache/fineract/pull/5980
Mailing List
https://lists.apache.org/thread/658yddn0bpxqw2hpxnyk3vqd05bkchg9
Mailing List
https://lists.apache.org/thread/d3bzcwsbywz7wg9zxvtlkvgmffqjyfn0
Mailing List
http://www.openwall.com/lists/oss-security/2026/07/15/1
More from Apache Fineract
8.1
CVE-2026-57821
Apache Fineract: Office list: SQL Injection via Subquery in orderBy
8.1
CVE-2026-56287
Apache Fineract: Boolean SQL Injection in Client Search API (orderBy parameter) leading to Local File Disclosure