CVE-2026-6428

Name of the Vulnerable Software and Affected Versions Koha Community Koha versions 22.11.0 through 22.11.37 Koha Community Koha versions 23.x Koha Community Koha versions 24.0 through 24.11.15 Koha Community Koha versions 25.05.0 through 25.05.10 Koha Community Koha versions 25.11.0 through 25.11.04 Koha Community Koha versions 26.05.0 through 26.05.00 Koha Community Koha versions 26.11.0 through 26.10.99

Description An authenticated staff user with the Reports module flag can read arbitrary data from the application database. This occurs when the Criteria parameter matches /branchcode/ in the 'reports/catalogue out.pl' endpoint. The issue stems from the calculate() function, which concatenates the unmodified Filter request parameter directly into a LIKE clause of a SQL statement and executes it via DBI without using bound parameters. This allows for error-based SQL injection, enabling full read access to sensitive tables such as borrowers (containing password hashes, 2FA secrets, and personally identifiable information), borrower password recovery, api keys, and sessions.

Recommendations Update Koha Community Koha version 22.11.37 to 22.11.38. Update Koha Community Koha versions 23.x to a version where the fix is applied. Update Koha Community Koha versions 24.x to 24.11.16. Update Koha Community Koha versions 25.05.x to 25.05.11. Update Koha Community Koha versions 25.11.x to 25.11.05. Update Koha Community Koha versions 26.05.x to 26.05.01. Update Koha Community Koha versions 26.11.x to 26.11.00.