What is the CVSS score of CVE-2026-72609?

CVE-2026-72609 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of Koha are affected by CVE-2026-72609?

Koha library management systems versions 24.11.17 through 26.05.01 contain a database vulnerability that could enable staff members with acquisition module access to extract patron and staff…. A patch is available.

How to fix or mitigate CVE-2026-72609?

Within 24 hours, inventory all Koha deployments to identify instances running versions 24.11.17, 25.05.12, 25.11.06, or 26.05.01, then immediately audit which staff members have access to the acqui/parcels.pl endpoint and review database logs for suspicious queries or unusual data extraction patterns. Within 7 days, revoke acquisition module access for all non-essential staff, enforce multi-factor authentication for all remaining acquisition module users, and deploy database query logging with alerting focused on the acquisitions schema. Within 30 days, establish weekly vendor contact with Koha Community for patch status, conduct forensic analysis of database access logs from the past 90 days for signs of exploitation, and complete a full inventory of potentially compromised patron records if unauthorized access is confirmed.

Koha CVE-2026-72609

EUVD-2026-56130 HIGH

SQL Injection (CWE-89)

2026-08-11 TuranSec

GHSA-f66q-gpm5-hp2p

SQLi Koha Koha Community

7.1

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

vuln.today AI

7.1 HIGH

Network-accessible endpoint; PR:L reflects required staff authentication with specific permission; C:H for full database read; I:N read-only; A:L for time-based query load.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Patch available

Aug 11, 2026 - 13:17 EUVD

Analysis Generated

Aug 11, 2026 - 12:21 vuln.today

CVE Published

Aug 11, 2026 - 11:22 cve.org

HIGH 7.1

DescriptionCVE.org

An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition => order_receive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The parameter is passed to C4::Acquisition::GetInvoices, which allow-lists the column name but concatenates the direction token raw into the SQL ORDER BY clause without validation. Exploitation is blind (time-based) in production and allows extraction of patron PII, staff bcrypt password hashes, and two-factor secrets.

AnalysisAI

SQL injection in Koha's acquisition module enables authenticated staff to blindly extract the entire database - including patron PII, staff bcrypt password hashes, and two-factor authentication secrets - via a crafted ORDER BY direction token in the acqui/parcels.pl endpoint. All active Koha release branches are affected through versions 24.11.17, 25.05.12, 25.11.06, and 26.05.01, meaning any library running a current release is exposed. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but successful exploitation yields credentials that could cascade into full staff account takeover.

Technical ContextAI

Koha is an open-source integrated library system (ILS) built in Perl. The vulnerable endpoint is acqui/parcels.pl, which handles acquisition parcel and invoice management. The orderby HTTP parameter is passed directly to the C4::Acquisition::GetInvoices Perl function. While that function applies an allow-list to sanitize the column name portion of the ORDER BY clause - a partial and incomplete control - it concatenates the sort direction token (expected to be ASC or DESC) into the SQL string without any validation or parameterization. An attacker can inject arbitrary SQL into this direction slot, yielding a time-based blind SQL injection (CWE-89: Improper Neutralization of Special Elements used in an SQL Command). Because the database stores patron personally identifiable information, staff bcrypt password hashes, and TOTP two-factor secrets in accessible tables, the read-only exploit surface translates to severe downstream credential exposure.

RemediationAI

Monitor the Koha community bug report at https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42749 and the release announcements at https://koha-community.org/ for a patched version; no fixed release has been confirmed from available data. As a compensating control, immediately audit and restrict the acquisition => order_receive permission to the minimum number of trusted staff accounts operationally required - reducing this grants fewer entry points without affecting patrons or non-acquisition staff. Enabling web application firewall rules that detect time-based SQL injection payloads (SLEEP, WAITFOR DELAY, BENCHMARK) in query parameters can provide detection and blocking capability with the trade-off of potential false positives on legitimate ORDER BY requests. Network-level controls that restrict database server egress to only necessary application hosts limit the utility of extracted data. Forced password rotation for all staff accounts with the affected permission should be considered if exploitation cannot be ruled out, given that bcrypt hashes and TOTP secrets may already have been targeted.