CVE-2026-72609 Koha Community CVE debrief

Who should care

Organizations using Koha versions through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 should be aware of this SQL injection vulnerability. Specifically, authenticated staff members with acquisition permissions are at risk of being exploited. The vulnerability could lead to unauthorized access to sensitive database information, including patron personally identifiable information (PII), staff password hashes, and two-factor authentication secrets.

Technical summary

The CVE-2026-72609 vulnerability is an SQL injection issue in Koha versions through 24.11.17, 25.05.12, 25.11.06, and 26.05.01. Authenticated staff with the acquisition => order_receive permission can exploit this vulnerability to read arbitrary database contents. The vulnerability is located in the orderby request parameter in acqui/parcels.pl, which is passed to C4::Acquisition::GetInvoices. This function allow-lists the column name but concatenates the direction token raw into the SQL ORDER BY clause without validation, leading to a blind time-based SQL injection vulnerability in production. This could allow extraction of sensitive data such as patron PII, staff bcrypt password hashes, and two-factor secrets.

Defensive priority

Authenticated staff with acquisition permissions could exploit this SQL injection vulnerability to extract sensitive data.

Recommended defensive actions

• Inventory and verify affected Koha versions
• Restrict acquisition permissions to minimal required
• Monitor for suspicious database queries
• Implement WAF rules for SQL injection prevention
• Apply vendor patches or updates when available

Evidence notes

The CVE description indicates an SQL injection vulnerability in Koha versions through 24.11.17, 25.05.12, 25.11.06, and 26.05.01. The vulnerability allows authenticated staff with acquisition => order_receive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The parameter is passed to C4::Acquisition::GetInvoices, which allow-lists the column name but concatenates the direction token raw into the SQL ORDER BY clause without validation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.