CVE-2026-35152 Apache Software Foundation CVE debrief

Who should care

Defenders of Apache Fineract deployments should assess exposure and prioritize upgrading to a fixed version. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review and implement necessary mitigations to prevent unauthorized data access.

Why it matters

CVE-2026-35152 is a SQL Injection vulnerability in Apache Fineract's Report Execution API that allows authenticated users to inject arbitrary SQL, potentially leading to unauthorized data access.

• Potential unauthorized access to sensitive data
• Possible elevation of privileges for authenticated users
• Required verification of report execution API access controls
• Need for monitoring report execution logs

Technical summary

A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to and including 1.14.0. Report parameter values are incorporated into the generated SQL query without sufficient validation, allowing an authenticated user with permission to run reports to inject arbitrary SQL via crafted parameter values. This can be leveraged to perform unauthorized access to data beyond what the report was designed to expose. Users are recommended to upgrade to a version containing the fix.

Defensive priority

Upgrade to a fixed version and restrict report execution access.

Recommended defensive actions

• Upgrade to a version of Apache Fineract containing the fix
• Restrict access to the Report Execution API to authorized users
• Monitor report execution logs for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD detail page provide information on the SQL Injection vulnerability in Apache Fineract's Report Execution API. The vulnerability exists in versions up to and including 1.14.0 and allows authenticated users to inject arbitrary SQL via crafted parameter values. This can be leveraged to perform unauthorized access to data beyond what the report was designed to expose. Users are recommended to upgrade to a version containing the fix. Evidence limits are based on CVE Program and NVD records.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.