CVE-2026-50766

Name of the Vulnerable Software and Affected Versions Koha Library Management System versions 0 through 25.11

Description A stored cross-site scripting (XSS) issue exists in the OPAC item detail page. An authenticated remote attacker with edit items permission can inject arbitrary web scripts through the items.itemnotes field. Stored XSS occurs when an application receives data from a user and includes that data within its later HTTP responses in an unsafe way, allowing the script to be executed in the browser of other users.

Recommendations Update Koha Library Management System to a version later than 25.11. Restrict the use of the items.itemnotes field for users with edit items permission until the system is updated.