A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET /api/v1/offices) in versions up to and including 1.14.0. The orderBy request parameter is concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view offices to inject arbitrary SQL via a crafted orderBy value. This is a bypass of the ColumnValidator fix introduced for CVE-2024-32838, which does not detect bare subqueries in the ORDER BY position. This can be leveraged to perform time-based blind SQL injection for data exfiltration. Because the injected query blocks the database connection for its full duration, concurrent exploitation can exhaust the application's database connection pool, resulting in denial of service for other users. Users are recommended to upgrade to a version containing the fix.
Fix
Public exploits 1
- tc4dy/CVE-2026-57821-PoC-Exploit PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/apache/fineract/pull/6048 Patch
- https://lists.apache.org/thread/lb7zwdv7qntzy6z05gzf7m8mxw9cbgsj Mailing List, Vendor Advisory
- https://lists.apache.org/thread/rj5vwh3z2xcvsf0rqwj8kokpbrxkhq4n Mailing List, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.1 · apacheNVD modified 2026-10-24 22:10
Affected (CPE criteria) 1
cpe:2.3:a:apache:fineract:*:*:*:*:*:*:*:*
References 3
- https://github.com/apache/fineract/pull/6048 Patch
- https://lists.apache.org/thread/lb7zwdv7qntzy6z05gzf7m8mxw9cbgsj Mailing List, Vendor Advisory
- https://lists.apache.org/thread/rj5vwh3z2xcvsf0rqwj8kokpbrxkhq4n Mailing List, Vendor Advisory