Zero Radar
← feed
HighVulnerabilityCVE-2026-64618updated 30 Oct 2026, 13:08 UTC

Apache Fineract search API can be tricked into running database commands

Attackers can send specially crafted input to a search feature and make the system run database commands they wrote. That can expose or change the financial records stored in the database.

Official, 3 sources
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 3 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends inputCrafted value in outStandingAmountPercentageCondition
  2. 2Request reaches APISearch API endpoint is reachable
  3. 3Input not sanitizedValue goes straight into the SQL command
  4. 4Database runs attacker SQLMalicious query executes with app rights
  5. 5Data exposed or changedFinancial records readable or modifiable
  6. ResultAttacker reads or alters database records

What happened

The outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance endpoint in Apache Fineract does not sanitize input, allowing SQL injection.

Why it is dangerous: An attacker who can reach the API may read, modify or delete data in the Fineract database, which holds loan and account records; operators running this system are at risk.

Are you affected?

You are affected if you run Apache Fineract through version 1.15.0 with the Search API (/fineract-provider/api/v1/search/advance) reachable.

Apache Fineract through 1.15.0

What to do

  1. Check whether you run Apache Fineract 1.15.0 or earlier and whether the Search API is reachable from untrusted networks
  2. Restrict access to the /fineract-provider/api/v1/search/advance endpoint until a fixed version is installed
  3. Watch the Apache Fineract project announcements and GitHub advisory GHSA-3536-74c2-mgrr for a patched release and upgrade when available

Timeline

  1. 30 Oct 2026, 02:58 UTC
    Publicly disclosed
  2. 30 Oct 2026, 02:58 UTC
    Reported by oss-security · oss-security
  3. 30 Oct 2026, 03:01 UTC
    Picked up by Zero Radar
  4. 30 Oct 2026, 09:19 UTC
    NVD reported on it · NVD
  5. 30 Oct 2026, 13:08 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 3 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Technical details

ID
CVE-2026-64618 · GHSA-3536-74c2-mgrr
EPSS
0.2% chance of exploitation within 30 days
Disclosed
30 Oct 2026, 02:58 UTC
On Zero Radar
30 Oct 2026, 03:01 UTC (3 min after disclosure)
Last change
30 Oct 2026, 13:08 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Apache Fineract search API can be tricked into running database commands · Zero Radar