SQL injection in Apache Fineract via ORDER BY parameters (CVE-2026-65874)

What happened and what to do

The advisory, published on the oss-sec mailing list on 29 October 2026, rates as important a SQL injection affecting Apache Fineract up to and including version 1.15.0. The flaw is in the centers read endpoint (GET /api/v1/centers) and in the datatables read endpoints, which directly concatenate the caller-supplied sorting parameters orderBy, sortOrder and order.

For a company running Fineract, the practical response starts with an inventory: identify instances and versions and check which integrations call these endpoints. Sorting parameters should not be treated as free text. The structural fix is to validate each field against a fixed allowlist of permitted columns, map the direction to ASC or DESC, and use parameterized queries for the remaining values. In parallel, it is worth logging and alerting on requests containing SQL-typical characters in these parameters, without treating that as a substitute for the fix. Regression tests in staging confirm that legitimate sorting keeps working.

How the consultancy can help

Exposure diagnosis: an inventory of Apache Fineract instances and of the integrations that use the affected endpoints, prioritized by exposure. Implementation of allowlist validation for sorting parameters, regression tests and monitoring of suspicious requests, with supported operation.

Next step

If your company runs Apache Fineract, send a short description of your environment and integrations, and receive a proposal with a defined scope for diagnosis and remediation.