CVE-2026-56287 is a boolean-based SQL Injection vulnerability in Apache Fineract's Client Search API (GET /api/v1/clients) affecting versions prior to 1.14.1. The vulnerability arises because the orderBy and sortOrder request parameters are concatenated directly into SQL queries without sufficient validation. An authenticated user with permission to view clients can exploit this to inject arbitrary SQL commands. On MySQL/MariaDB databases, this can be leveraged to read arbitrary files accessible to the database process using the LOAD_FILE() function. The vulnerability allows blind boolean-based data extraction, potentially exposing sensitive data. No official patch or remediation level is explicitly stated in the provided data, but users are recommended to upgrade to a version containing the fix.

An authenticated user with client view permissions can exploit this vulnerability to perform blind boolean-based SQL injection attacks, potentially extracting sensitive data from the database. Additionally, on MySQL/MariaDB backends, the attacker can read arbitrary files accessible to the database process via the LOAD_FILE() function, increasing the risk of sensitive information disclosure.

Users should upgrade Apache Fineract to version 1.14.1 or later, which contains the fix for this vulnerability. Patch status is not explicitly confirmed beyond this recommendation, so users should verify the vendor advisory for the latest remediation guidance.