CVE-2026-70369

Name of the Vulnerable Software and Affected Versions Koha (affected versions not specified)

Description An authenticated staff user with reports module permissions can perform SQL injection via the reports/acquisitions stats.pl endpoint. The issue occurs in the calculate() function, where user-controlled Filter request parameters are interpolated directly into WHERE fragments for aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget code, aqorders.sort1, and aqorders.sort2 without using bound parameters. This allows the attacker to execute arbitrary SQL and access sensitive tables, including borrowers (containing password hashes, two-factor secrets, and personal data), borrower password recovery, api keys, and sessions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.