CVE-2026-72607
Received Received - Intake

Stored SQL Injection in Koha Library Software

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => items_batchmod permission to read arbitrary database contents by storing a SQL payload in the agefield value of an automatic item modification rule. The agefield value is stored verbatim to the system preference and later interpolated without parameterization into a SQL query in C4::Items::ToggleNewStatus (line 1228) when the scheduled cron job executes. The injection is SELECT-only under standard MariaDB/MySQL DBI single-statement execution; a time-based SLEEP payload is also achievable via the cron trigger. An attacker can read the entire Koha database including patron PII and staff bcrypt password hashes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-72607
EUVD
EUVD-2026-56128

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
koha koha to 24.11.17|end_including=25.05.12|end_including=25.11.06|end_including=26.05.01 (inc)
koha koha From 24.11.17 (inc) to 26.05.01 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

A stored SQL injection vulnerability exists in Koha library software versions up to 26.05.01. Authenticated staff with specific permissions can inject malicious SQL code into an item modification rule. The payload is stored and later executed when a scheduled cron job runs, allowing unauthorized database access including reading sensitive data like patron PII and staff password hashes.

Detection Guidance

Check Koha system preferences for suspicious agefield values in automatic item modification rules. Review cron job logs for C4::Items::ToggleNewStatus execution with unexpected SQL patterns. Inspect database queries for direct string interpolation without parameterization.

Impact Analysis

This vulnerability allows attackers to read sensitive data from the Koha database, including patron personally identifiable information and staff password hashes. It could lead to data breaches, identity theft, or unauthorized access to library systems and patron accounts if exploited.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR and HIPAA by exposing protected health information or personally identifiable data. Organizations using vulnerable Koha versions may face compliance violations, regulatory fines, and reputational damage due to unauthorized data access.

Mitigation Strategies

Upgrade Koha to a patched version beyond 24.11.17, 25.05.12, 25.11.06, and 26.05.01. Remove or restrict the tools => items_batchmod permission for staff accounts. Audit and sanitize all agefield values in automatic item modification rules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72607. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart