The flaw is a cross‑site scripting vulnerability that lets an authenticated administrator inject arbitrary JavaScript into the patron restriction type administration page. The injected code runs in the browsers of any user who views that page, enabling session hijacking, defacement, or exfiltration of sensitive information.

Koha Library Management System versions up to and including 25.11 are affected. The vulnerability is active for all users who possess administrator privileges and can create or edit restriction type labels through the display_text field.

The CVSS score is not disclosed and no EPSS value is available, so the exact severity cannot be quantified. The vulnerability requires administrative credentials, which limits the attack surface, but if an attacker controls an administrator account the risk is significant because injected scripts execute on every user who visits the page. The exploit is known to be in the public domain and is not listed in the CISA KEV catalog, indicating that it may not yet have seen widespread exploitation.