Core Banking System Flaw: Apache Fineract IDOR Risks Authorization Bypass & Customer Data Access

A trio of vulnerabilities has been disclosed in Apache Fineract, the open-source core banking system, ranging from an IDOR authorization bypass to weak credential protections. The most concerning flaw is CVE-2025-58137, an Insecure Direct Object Reference in the self-service API that could let an attacker manipulate parameters such as a user ID or account number in an API request to access or modify other users’ data.

The advisory states the IDOR flaw enables authorization bypass through a user-controlled key, with potential consequences for customer financial records. Two other issues were patched in the same sweep: CVE-2025-23408, a weak password policy affecting versions through 1.10.1, and CVE-2025-58130, unmasked server keys affecting versions through 1.11.0.

The Apache Fineract team released fixes in intermediate versions 1.11.0 and 1.12.1, but recommends leaping to the latest stable build, version 1.13.0, to guard against all three threats.