The exposed endpoints construct an SQL ORDER BY clause by concatenating user‑supplied parameters directly into the query. A bypass of the existing regex validation permits attackers to inject malicious SQL, resulting in a time‑based blind SQL injection. This weakness (CWE‑89) can let an authenticated user read sensitive database contents through repeated queries, impacting confidentiality of center records and custom datatables.

Apache Fineract versions 1.15.0 and earlier are vulnerable. The bug appears in the Center read endpoint (GET /api/v1/centers) and in the datatable read endpoints (GET /api/v1/datatables/{datatable}/{apptableId} and GET /api/v1/datatables/{datatable}/{apptableId}/{datatableId}). All users with read access to centers or the target datatable are affected.

The CVSS score is not available, and the EPSS score is not provided; the vulnerability is not listed in CISA KEV. The exploitation requires only authenticated read permissions to the affected resources, so any user granted that privilege could trigger the injection. Attackers can leverage the time‑based blind technique to infer database contents, potentially leading to broader data compromise.