{"cve":"CVE-2026-35152","nvd":{"published":"2026-07-15T10:16:46.850","modified":"2026-10-24T22:10:00.210","status":"Analyzed","description":"A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to and including 1.14.0. Report parameter values are incorporated into the generated SQL query without sufficient validation, allowing an authenticated user with permission to run reports to inject arbitrary SQL via crafted parameter values. This can be leveraged to perform unauthorized access to data beyond what the report was designed to expose. Users are recommended to upgrade to a version containing the fix.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cwes":["CWE-89"],"references":["https://github.com/apache/fineract/pull/5980","https://lists.apache.org/thread/658yddn0bpxqw2hpxnyk3vqd05bkchg9","https://lists.apache.org/thread/d3bzcwsbywz7wg9zxvtlkvgmffqjyfn0","http://www.openwall.com/lists/oss-security/2026/07/15/1"],"products":["apache:fineract"],"source":"nvd","synced_at":"2026-10-25T17:50:08.599881581+00:00"},"epss":{"cve":"CVE-2026-35152","score":0.03281,"percentile":0.88356,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}