CVE-2026-70369 Koha Community CVE debrief

Who should care

Koha users and administrators, especially those with the reports module permission, should be aware of this vulnerability and take steps to mitigate it. This includes restricting access to the reports module, monitoring for suspicious activity, and applying vendor patches. Additionally, security teams and vulnerability management teams should review the vulnerability and assess their exposure to it, considering compensating controls if patches are not feasible in the short term. Operators of Koha installations should also be aware of the potential impact on their systems and take steps to protect sensitive data. Platform and security teams may need to coordinate to ensure proper mitigation and verify the effectiveness of controls. This vulnerability could have significant operational impact if exploited, making it essential for affected organizations to prioritize mitigation efforts. To further assess and mitigate this vulnerability, defenders should consider reviewing relevant documentation, assessing their specific exposure, and verifying the effectiveness of their controls. They should also monitor for potential anomalies and adjust their security posture accordingly. Finally, they should ensure that their Koha installations are up-to-date and patched to prevent exploitation of this vulnerability. This may involve coordinating with vendors, applying patches, or implementing compensating controls to limit exposure. By taking these steps, defenders can reduce the risk associated with this vulnerability and protect sensitive information. In addition, defenders should consider tracking exceptions, retesting remediated assets, and closing items only after evidence is documented to ensure that mitigation efforts are effective and sustainable over time. This will help to minimize the operational impact of this vulnerability and ensure the security of Koha installations. To support these efforts, defenders may need to review relevant logs and monitoring data to identify potential security incidents and adjust their response accordingly. By prioritizing mitigation efforts and taking a proactive approach to security, defenders can minimize the risk associated with this

Technical summary

The reports/acquisitions_stats.pl script in Koha interpolates user-controlled Filter request parameters directly into WHERE fragments of a SQL query without bound parameters. This allows an authenticated staff user with reports module permission to inject arbitrary SQL and read any table accessible by the Koha database user, potentially exposing sensitive information such as password hashes, two-factor secrets, and personal data.

Defensive priority

Authenticated staff users with reports module permissions may be able to inject SQL; verify and restrict report module access, monitor for anomalies, and apply vendor patches.

Recommended defensive actions

• Restrict access to the reports module to only necessary personnel
• Monitor acquisitions_stats.pl for suspicious activity
• Apply patches from Koha Community
• Inventory Koha installations for exposure
• Consider compensating controls like database access restrictions

Evidence notes

The CVE description indicates that Koha's reports/acquisitions_stats.pl is vulnerable to SQL injection via user-controlled Filter request parameters. An authenticated staff user with reports module permission can inject arbitrary SQL. The vulnerability allows reading any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), borrower_password_recovery, api_keys, and sessions. To verify and mitigate this vulnerability, defenders should review the Koha documentation and codebase, check for exposure in their installations, and apply patches or compensating controls as necessary.

Official resources