CVE-2026-57821

{
  "id": "CVE-2026-57821",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-15T10:16:47.620",
  "lastModified": "2026-10-24T22:10:00.210",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET /api/v1/offices) in versions up to and including 1.14.0. The orderBy request parameter is concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view offices to inject arbitrary SQL via a crafted orderBy value. This is a bypass of the ColumnValidator fix introduced for CVE-2024-32838, which does not detect bare subqueries in the ORDER BY position. This can be leveraged to perform time-based blind SQL injection for data exfiltration. Because the injected query blocks the database connection for its full duration, concurrent exploitation can exhaust the application's database connection pool, resulting in denial of service for other users. Users are recommended to upgrade to a version containing the fix."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyección SQL existe en la API de búsqueda de oficinas de Apache Fineract (GET /api/v1/offices) en versiones hasta la 1.14.0 inclusive. El parámetro de solicitud orderBy se concatena en una consulta SQL sin validación suficiente, permitiendo a un usuario autenticado con permiso para ver oficinas inyectar SQL arbitrario a través de un valor orderBy manipulado. Esto es un bypass de la corrección de ColumnValidator introducida para CVE-2024-32838, que no detecta subconsultas simples en la posición ORDER BY. Esto puede ser aprovechado para realizar una inyección SQL ciega basada en tiempo para la exfiltración de datos. Debido a que la consulta inyectada bloquea la conexión de la base de datos durante toda su duración, la explotación concurrente puede agotar el pool de conexiones a la base de datos de la aplicación, resultando en denegación de servicio para otros usuarios. Se recomienda a los usuarios actualizar a una versión que contenga la corrección."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Fineract",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.14.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "1.15.0",
              "versionType": "semver",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-15T12:26:07.260895Z",
          "id": "CVE-2026-57821",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:fineract:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "1.15.0",
              "matchCriteriaId": "01D84ABB-BFCA-4D60-907C-27E2C6EAB370"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/apache/fineract/pull/6048",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://lists.apache.org/thread/lb7zwdv7qntzy6z05gzf7m8mxw9cbgsj",
      "source": "[email protected]",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://lists.apache.org/thread/rj5vwh3z2xcvsf0rqwj8kokpbrxkhq4n",
      "source": "[email protected]",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ]
    }
  ]
}