Cyber ·
CVE-2026-65874: SQL injection in Apache Fineract via ORDER BY parameters
Security advisory: Apache Fineract up to version 1.15.0 is affected by SQL injection in sorting parameters of center and datatable entry endpoints. The advisory reports an important severity.
According to the disclosure mirrored on the oss-sec feed, published on 29 October 2026, the flaw CVE-2026-65874 affects Apache Fineract up to and including version 1.15.0, with severity rated as important. The problem comes from concatenating sorting parameters supplied by the caller (orderBy, sortOrder and order) in read endpoints for centers and for datatable entries. The text received is an automatic translation of the original content, so technical terms and the description should be checked against the source.
Rota Nacional does not fix Fineract or replace the project's own updates. To consult and verify, read the original advisory in the oss-sec archive for the stated period and confirm in the official Apache Fineract documentation which version fixes the flaw. If your team uses AI to study the advisory, do not paste logs, queries with real data or customer records. The platform detects personal data such as CPF, CNPJ, e-mail, phone numbers and names before any model runs, and applies your organization's policy with placeholders, removal or a block.
Original source: CVE-2026-65874: injeção de SQL no Apache Fineract via parâmetros ORDER BY