The vulnerability is an SQL injection in the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance endpoint. This flaw arises from insufficient input neutralization, allowing an attacker to inject arbitrary SQL statements. If successfully exploited, the attacker could read, modify, or delete data from the Fineract database, compromising confidentiality and integrity of financial records.

Affected products are Apache Fineract versions up to and including 1.15.0. The vendor, Apache Software Foundation, identified the issue in the Search API module. System administrators should verify if their deployment runs a version older than 1.16.1, which contains the fix. The specific parameter affected is outStandingAmountPercentageCondition, used in advanced search queries.

No CVSS or EPSS score is provided, and the vulnerability has not been listed in CISA KEV, so the exploitation probability is uncertain. However, SQL injection is a high‑impact flaw, and the endpoint is accessible over the network. Based on common API exposure, it is inferred that the attack vector is network‑based from any user with API access. The risk remains significant until a patch is applied.