An SQL injection flaw in Koha’s reports/catalogue_out.pl enables an authenticated staff user with the Reports module privilege to read arbitrary data from the Koha database. By supplying a specially crafted Filter URL parameter when the Criteria field is set to /branchcode/, the attacker can reference any table, potentially exposing sensitive borrower details, password hashes, two‑factor secrets, API keys, and session data. The vulnerability is identified as CWE‑89 and is limited to data exfiltration, not arbitrary code execution.

The issue exists in Koha Community Edition versions 22.11.37 and earlier, all 23.x releases, every 24.x release prior to 24.11.16, every 25.05.x prior to 25.05.11, every 25.11.x prior to 25.11.05, every 26.05.x prior to 26.05.01, and every 26.11.x prior to 26.11.00. All affected builds are maintained by the Koha Community and are distributed under the Koha project.

With a CVSS score of 5.6 the flaw is considered medium severity; the EPSS score is less than 1%, and it is not listed in the CISA KEV catalog. An attacker who is authenticated and has the Reports flag can launch an error‑based SQL injection by sending a crafted request such as the example in the advisory. The exploitation does not require elevated privilege beyond the staff account, but once the flaw is abused any database table can be read, exposing highly sensitive data. Because the vulnerability is only exploitable by users who already have access to the reports interface, immediate patching is the most effective mitigation.