What is the CVSS score of CVE-2026-72607?

CVE-2026-72607 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of Koha are affected by CVE-2026-72607?

A stored SQL injection vulnerability in Koha library management software allows authenticated staff with specific permissions to inject SQL into a configuration tool, resulting in complete database…. A patch is available.

How to fix or mitigate CVE-2026-72607?

Within 24 hours: Audit all staff accounts with items_batchmod permission and restrict access to only staff requiring it for operational duties; disable or restrict access to the automatic item modifications configuration if operationally feasible. Within 7 days: Implement input validation rules to block SQL special characters in the configuration field; enable database access logging and alerting for unexpected query patterns; review 90-day audit logs for suspicious configuration changes. Within 30 days: Establish quarterly access reviews for items_batchmod permission; coordinate with Koha vendor to plan deployment of a security patch once released; conduct full regression testing before production deployment of any patches.

Koha CVE-2026-72607

EUVD-2026-56128 HIGH

SQL Injection (CWE-89)

2026-08-11 TuranSec

GHSA-wghp-4m28-j8pj

SQLi Koha Koha Community

7.1

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

vuln.today AI

7.1 HIGH

Network-accessible web interface (AV:N), no complexity beyond holding the items_batchmod permission (AC:L, PR:L), cron executes without further interaction (UI:N), full DB read but limited write influence only (C:H/I:L/A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Patch available

Aug 11, 2026 - 13:17 EUVD

Analysis Generated

Aug 11, 2026 - 12:21 vuln.today

CVE Published

Aug 11, 2026 - 11:22 cve.org

HIGH 7.1

DescriptionCVE.org

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => items_batchmod permission to execute arbitrary SQL via the agefield value in the automatic item modifications by age tool. The agefield value is stored verbatim and later interpolated without escaping into a SQL query in C4::Items::ToggleNewStatus when the scheduled cron job executes. An attacker can read the entire Koha database including patron PII and staff password hashes, and influence which items the batch job modifies.

AnalysisAI

Stored SQL injection in Koha library management software allows authenticated staff holding the items_batchmod permission to plant unsanitized SQL inside the 'automatic item modifications by age' configuration tool, which is later executed verbatim by the scheduled cron job through C4::Items::ToggleNewStatus. Successful exploitation exposes the entire Koha database - including patron personally identifiable information and staff password hashes - and lets the attacker manipulate which library items the batch modification job processes. No CISA KEV listing and no public exploit code have been identified at time of analysis; the deferred, cron-triggered execution model decouples the attacker's action from the database impact, complicating real-time detection.

Technical ContextAI

Koha (cpe:2.3:a:koha_community:koha) is an open-source Integrated Library System implemented primarily in Perl and used by public, academic, and school libraries worldwide. The vulnerability is classified CWE-89 (SQL Injection) and originates in the 'automatic item modifications by age' administrative tool: a staff-supplied agefield parameter is written to the database without sanitization and later interpolated directly into a SQL query string inside the C4::Items::ToggleNewStatus Perl subroutine when a scheduled cron job fires. The root cause is the absence of parameterized queries at the point of SQL construction - input is neutralized neither on storage nor on query assembly. The stored nature of the injection means the malicious payload persists in the database between the attacker's configuration action and the cron-triggered execution event, creating a temporal gap that separates attack delivery from exploitation and makes incident correlation harder.

RemediationAI

Upgrade Koha to the first release beyond the affected boundary on the relevant maintenance branch: a version later than 24.11.17 on the 24.11 branch, later than 25.05.12 on the 25.05 branch, later than 25.11.06 on the 25.11 branch, or later than 26.05.01 on the 26.05 branch. Specific fixed release numbers are not confirmed in the available intelligence data - consult https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42746 and https://koha-community.org/ for the exact patched release per branch. As a compensating control pending upgrade, restrict the 'tools => items_batchmod' permission to the minimum set of staff who operationally require it, reducing the population that can plant a malicious payload; note this may interrupt routine batch modification workflows for demoted staff. Auditing the Koha database for unexpected or anomalous agefield values in the relevant configuration table can identify whether exploitation has already occurred. Temporarily disabling the ToggleNewStatus cron job prevents execution of any stored payload but halts the legitimate automatic item modification workflow entirely until patching is complete.