CVE-2026-72609

Name of the Vulnerable Software and Affected Versions Koha versions 24.11.17 through 26.05.01

Description An SQL injection issue exists where authenticated staff members possessing the acquisition => order receive permission can read arbitrary database contents. The flaw occurs in the acqui/parcels.pl endpoint via the orderby request parameter. This parameter is processed by the C4::Acquisition::GetInvoices function, which validates the column name but fails to validate the direction token before concatenating it into the SQL ORDER BY clause. This allows for blind time-based exploitation to extract patron personally identifiable information (PII), staff bcrypt password hashes, and two-factor secrets.

Recommendations Update Koha to a version later than 26.05.01. As a temporary mitigation, restrict the acquisition => order receive permission to only trusted staff members or avoid using the orderby parameter in the acqui/parcels.pl endpoint.