CVE-2026-35152: apache fineract

csirt@kutim:~/threat-intel/cve/CVE-2026-35152

CVSS 8.8 · High EPSS 3,3%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada apache fineract. Skor CVSS 3.1 8.8 (High) menurut CISA ADP.

Deskripsi (NVD)

A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to and including 1.14.0. Report parameter values are incorporated into the generated SQL query without sufficient validation, allowing an authenticated user with permission to run reports to inject arbitrary SQL via crafted parameter values. This can be leveraged to perform unauthorized access to data beyond what the report was designed to expose. Users are recommended to upgrade to a version containing the fix.

Rincian

Terbit di NVD: 15 Juli 2026
Terakhir diubah: 15 Juli 2026
Status NVD: Analyzed
CVSS 3.1: 8.8 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
EPSS (30 hari): 3,3% peluang dieksploitasi; lebih tinggi dari 88,1% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
apache	fineract	Semua versi sebelum 1.15.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://lists.apache.org/thread/658yddn0bpxqw2hpxnyk3vqd05bkchg9 mailing list · advisory vendor
https://lists.apache.org/thread/d3bzcwsbywz7wg9zxvtlkvgmffqjyfn0 mailing list · advisory vendor
https://github.com/apache/fineract/pull/5980 patch
http://www.openwall.com/lists/oss-security/2026/07/15/1 mailing list · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.