CVE-2026-72607

Name of the Vulnerable Software and Affected Versions Koha versions 24.11.17 through 26.05.01

Description A stored SQL injection exists where authenticated staff with tools => items batchmod permissions can read arbitrary database contents, including patron personally identifiable information (PII) and staff bcrypt password hashes. The issue occurs when a SQL payload is stored in the agefield value of an automatic item modification rule. This value is saved to the system preference and subsequently interpolated without parameterization into a SQL query within the C4::Items::ToggleNewStatus() function during the execution of a scheduled cron job. Under standard MariaDB/MySQL DBI single-statement execution, the injection is limited to SELECT operations, although time-based SLEEP payloads are also possible via the cron trigger.

Recommendations Update Koha to a version later than 26.05.01. As a temporary mitigation, restrict the tools => items batchmod permission to only highly trusted staff members.