CVE-2026-65874

Name of the Vulnerable Software and Affected Versions Apache Fineract versions prior to 1.16.1

Description Authenticated users with read access to centers or targeted datatables can perform time-based blind SQL injection. This occurs because the application concatenates caller-supplied ordering parameters directly into the SQL ORDER BY clause, bypassing existing regex-based input validation. The affected API endpoints are '/api/v1/centers', '/api/v1/datatables/{datatable}/{apptableId}', and '/api/v1/datatables/{datatable}/{apptableId}/{datatableId}'. The vulnerable parameters are orderBy, sortOrder, and order.

Recommendations Upgrade to version 1.16.1.