Description
A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => items_batchmod permission to read arbitrary database contents by storing a SQL payload in the agefield value of an automatic item modification rule. The agefield value is stored verbatim to the system preference and later interpolated without parameterization into a SQL query in C4::Items::ToggleNewStatus (line 1228) when the scheduled cron job executes. The injection is SELECT-only under standard MariaDB/MySQL DBI single-statement execution; a time-based SLEEP payload is also achievable via the cron trigger. An attacker can read the entire Koha database including patron PII and staff bcrypt password hashes.
Published: 2026-08-11
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A stored SQL injection flaw exists in Koha Community versions up to 26.05.01, triggered by inserting an SQL payload into the agefield of an automatic item modification rule. The value is saved verbatim and later interpolated without parameterization into a query executed by a scheduled cron job. As a result, authenticated staff possessing the items_batchmod permission can execute arbitrary SELECT statements, including time‑based SLEEP payloads, to read the entire Koha database. The data exposed includes patron PII and staff bcrypt password hashes.

Affected Systems

The vulnerability affects the Koha Community software in the following releases: 24.11.17, 25.05.12, 25.11.06, and 26.05.01. Versions released after 26.05.01 incorporate the fix, but any installation still running these or older versions is vulnerable.

Risk and Exploitability

The CVSS score of 7.1 reflects a moderate to high severity. The EPSS score is not available, and the bug is not listed in the CISA KEV catalog. The attack requires authenticated staff with the items_batchmod permission, and the vector is internal via the scheduled cron trigger. An attacker can read all database contents, posing a severe confidentiality risk but no direct remote code execution or privilege escalation.

Generated by OpenCVE AI on August 12, 2026 at 11:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest Koha release that contains the fix for this vulnerability.
  • Revoke the items_batchmod permission from any staff accounts that do not require it, and reassess group privileges to limit the ability to create or modify automatic item modification rules.
  • Disable or reconfigure the automatic item modification rule that uses the agefield value, ensuring that any dynamic SQL contains proper parameterization or is replaced with a safe static value.

Generated by OpenCVE AI on August 12, 2026 at 11:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 11 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Koha-community
Koha-community koha
Vendors & Products Koha-community
Koha-community koha

Tue, 11 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 11 Aug 2026 12:00:00 +0000

Type Values Removed Values Added
Description A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => items_batchmod permission to execute arbitrary SQL via the agefield value in the automatic item modifications by age tool. The agefield value is stored verbatim and later interpolated without escaping into a SQL query in C4::Items::ToggleNewStatus when the scheduled cron job executes. An attacker can read the entire Koha database including patron PII and staff password hashes, and influence which items the batch job modifies. A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => items_batchmod permission to read arbitrary database contents by storing a SQL payload in the agefield value of an automatic item modification rule. The agefield value is stored verbatim to the system preference and later interpolated without parameterization into a SQL query in C4::Items::ToggleNewStatus (line 1228) when the scheduled cron job executes. The injection is SELECT-only under standard MariaDB/MySQL DBI single-statement execution; a time-based SLEEP payload is also achievable via the cron trigger. An attacker can read the entire Koha database including patron PII and staff bcrypt password hashes.
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'}

 cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L'}

Tue, 11 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
Description A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => items_batchmod permission to execute arbitrary SQL via the agefield value in the automatic item modifications by age tool. The agefield value is stored verbatim and later interpolated without escaping into a SQL query in C4::Items::ToggleNewStatus when the scheduled cron job executes. An attacker can read the entire Koha database including patron PII and staff password hashes, and influence which items the batch job modifies.
Title Koha Community Koha - Stored SQL Injection via agefield in Automatic Item Modifications by Age
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'}

Subscriptions

Koha-community Koha
cve-icon MITRE

Status: PUBLISHED

Assigner: TuranSec

Published:

Updated: 2026-08-11T12:10:18.466Z

Reserved: 2026-08-10T10:33:03.258Z

Link: CVE-2026-72607

cve-icon Vulnrichment

Updated: 2026-08-11T12:10:08.775Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-11T12:17:43.867

Modified: 2026-08-28T18:51:07.660

Link: CVE-2026-72607

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-12T11:30:03Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')