CVE-2026-71288 Koha Community CVE debrief

Who should care

Organizations using Koha should be concerned about this vulnerability, especially those with staff accounts that have create_reports or execute_reports permissions. The vulnerability could allow attackers to access sensitive data, including patron PII and staff/LDAP credentials. IT teams responsible for Koha deployments, security teams, and vulnerability management teams should prioritize assessment and remediation efforts. Additionally, operators of Koha installations and platform administrators should review and restrict access to the guided report builder feature to minimize exposure.

Technical summary

The guided report builder feature in Koha is vulnerable to SQL injection attacks due to improper handling of user input in the `order_by` and `order_ovalue` CGI parameters. This allows low-privilege staff accounts to perform time-based blind SQL injection against the Koha database, potentially exposing sensitive data such as patron PII and staff/LDAP credentials. To mitigate, prioritize compensating controls and monitor for suspicious database activity.

Defensive priority

CVE-2026-71288 is rated HIGH with a CVSS score of 8.8; prioritize defensive actions for staff accounts with create_reports or execute_reports permissions.

Recommended defensive actions

• Inventory and verify the create_reports and execute_reports permissions for all staff accounts.
• Implement compensating controls to restrict SQL injection attempts.
• Monitor for suspicious database queries.
• Apply vendor patches or workarounds when available.
• Restrict access to the guided report builder feature.

Evidence notes

The CVE description indicates that Koha's guided report builder is vulnerable to SQL injection via the `order_by` and `order_ovalue` CGI parameters. This allows staff accounts with create_reports or execute_reports permissions to perform time-based blind SQL injection. To verify, defenders should review the Koha codebase, specifically the guided report builder feature, and assess the database schema for potential exposure. Additional review of database logs and monitoring for suspicious queries may be necessary.

Official resources