CVE-2026-56287: Apache Fineract: Boolean SQL Injection in Client Search API (orderBy parameter) leading to Local File Disclosure

[Terence Monteiro <terencemo () apache org>]

Severity: important 

Affected versions:

- Apache Fineract 1.14.0
- Apache Fineract 1.15.0 unaffected

Description:

A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/v1/clients) in 
versions up to and including 1.14.0. The orderBy and sortOrder request parameters are concatenated into a SQL query 
without sufficient validation, allowing an authenticated user with permission to view clients to inject arbitrary SQL 
via a crafted orderBy value. This can be leveraged to perform blind boolean-based data extraction and, on 
MySQL/MariaDB, to disclose arbitrary files readable by the database process via the LOAD_FILE() function. Users are 
recommended to upgrade to a version containing the fix

Credit:

Anirudh Anand (finder)
Aman Sapra (reporter)
Terence Monteiro (@terencemo) (remediation developer)
Ádám Sághy (@adamsaghy) (remediation reviewer)

References:

https://fineract.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-56287