PatchSiren

Koha CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM Koha CVE published 2026-06-26

CVE-2026-50767

CVE-2026-50767 is a stored cross-site scripting (XSS) vulnerability in the item type administration page of Koha Library Management System through 25.11. An authenticated remote attacker with administrator privileges can inject arbitrary web scripts via the item type check-in message field (checkinmsg). The vulnerability has a CVSS score of 5.4 and a severity of MEDIUM. The CVE was published on 2026-06-26 [truncated]