CVE-2026-72607 Koha Community CVE debrief

Who should care

Koha users and administrators, especially those with staff members having the tools => items_batchmod permission, should be aware of this vulnerability and take necessary actions to mitigate it. They should review their current permissions, monitor for suspicious activity, and implement security measures to prevent exploitation. Additionally, they should consider updating Koha to a version that addresses this vulnerability and restrict access to sensitive database contents.

Technical summary

A stored SQL injection vulnerability in Koha allows authenticated staff with the tools => items_batchmod permission to read arbitrary database contents by storing a SQL payload in the agefield value of an automatic item modification rule. The agefield value is stored verbatim and later interpolated without parameterization into a SQL query in C4::Items::ToggleNewStatus when the scheduled cron job executes. This vulnerability can be exploited to read the entire Koha database, including patron PII and staff bcrypt password hashes.

Defensive priority

Authenticated staff with specific permissions may exploit this vulnerability to read arbitrary database contents.

Recommended defensive actions

• Inventory and verify the tools => items_batchmod permission is not granted to unauthorized staff.
• Implement parameterization for SQL queries to prevent injection.
• Monitor for suspicious database queries and cron job executions.
• Restrict access to sensitive database contents.
• Update Koha to a version that addresses this vulnerability.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is a stored SQL injection issue in Koha, allowing authenticated staff to read arbitrary database contents. The issue arises from the agefield value of an automatic item modification rule being stored verbatim and later interpolated without parameterization into a SQL query. To verify and mitigate this vulnerability, defenders should review the tools => items_batchmod permission, check for suspicious database queries and cron job executions, and restrict access to sensitive database contents. Additionally, they should consider implementing parameterization for SQL queries to prevent injection and monitor for potential exploitation attempts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.