CVE-2026-72610 Koha Community CVE debrief

Who should care

Koha users and administrators, especially those with staff members who have borrowers => edit_borrowers permission, should be aware of this vulnerability. They should verify their Koha versions, assess exposure, and implement necessary mitigations to prevent exploitation. IT security teams responsible for Koha deployments should prioritize patching and monitor for suspicious activity. Additionally, security teams should review system logs for signs of potential exploitation and conduct regular security audits to identify similar vulnerabilities.

Technical summary

A stored SQL injection vulnerability in Koha allows authenticated staff with borrowers => edit_borrowers permission to cause a time-based denial of service by storing a SQL payload in a patron lang field. The payload executes on each subsequent issue-slip print. The vulnerability affects Koha versions through 24.11.17, 25.05.12, 25.11.06, and 26.05.01. The 25-character column length limits exploitation to timing attacks; data extraction is not practical.

Defensive priority

Authenticated staff with borrowers => edit_borrowers permission can cause a time-based denial of service via stored SQL payload in patron lang field.

Recommended defensive actions

• Inventory and verify affected Koha versions
• Restrict borrowers => edit_borrowers permission to trusted staff
• Monitor for suspicious issue slip printing activity
• Apply vendor remediation when available
• Implement compensating controls for SQL injection
• Review system logs for signs of potential exploitation
• Conduct regular security audits to identify similar vulnerabilities

Evidence notes

The vulnerability exists in Koha versions through 24.11.17, 25.05.12, 25.11.06, and 26.05.01. The 25-character column length limits exploitation to timing attacks; data extraction is not practical. Affected Koha deployments should verify their versions and assess exposure based on staff permissions. To verify exposure, defenders should check for staff with borrowers => edit_borrowers permission and monitor for suspicious issue slip printing activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.