Koha ILS EUVD-2026-100898

Requires an authenticated Koha staff account holding the reports module permission (superlibrarian is explicitly NOT required), reachable via the Most-circulated items report feature backed by reports/cat_issues_top.pl. The attacker supplies malicious values in the Criteria, Filter, or Limit request parameters: Criteria is only prefix-normalized and never validated against an allow-list, so it reaches identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY) verbatim; Filter values are concatenated raw into single-quoted LIKE/BETWEEN/comparison fragments; Limit is appended raw to the LIMIT clause. The principal limiting factor is the PR:L staff-authentication-plus-reports-permission gate - there is no unauthenticated path, no required user interaction beyond the attacker's own session, and the data reachable is bounded by the privileges of the Koha database user. Unpatched versions prior to 24.11.19 / 25.05.14 / 25.11.08 / 26.05.03 are affected.

This is a genuine, well-characterized SQL injection (CWE-89) that merits prompt patching but is not a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L) scores 7.2 High and is internally consistent with the description: network-reachable, low complexity, but requiring low-level privileges (PR:L) - an authenticated staff account holding the reports module permission. Confidentiality impact is High (VC:H) because the Koha database user can read the borrowers table, including userids, bcrypt password hashes, two-factor secrets, api_keys, and sessions; integrity/availability are only Low because the described impact is data disclosure rather than modification or destruction. No EPSS score, KEV listing, or POC was supplied in the input, so this is no public exploit identified at time of analysis - do not treat it as actively exploited. However, the bug is explicitly the unpatched twin of reports/bor_issues_top.pl (CVE-2026-70372), the injection pattern is fully disclosed in the advisory (verbatim concatenation of Criteria/Filter/Limit into identifier and value positions), and exploitation is trivial for anyone with the required privilege level, so a working exploit is low-effort to derive. The main risk-limiting factor is the PR:L authentication requirement - the attacker must already be an authenticated staff user, which narrows the threat to insiders or attackers who have obtained staff credentials. Net: a real priority for any internet-exposed or multi-staff Koha deployment, but gated by staff authentication rather than being unauthenticated-remote.

An authenticated staff user (or an attacker who has phished/reused staff credentials) with only the reports module permission opens the Most-circulated items report and submits crafted Criteria, Filter, or Limit parameters to reports/cat_issues_top.pl. Because these values are concatenated verbatim into dynamic SQL, the attacker injects a UNION/subquery that dumps the borrowers table, exfiltrating userids, bcrypt password hashes, two-factor secrets, api_keys, and session data. No public exploit was identified at time of analysis, but the vulnerable code path and technique are fully disclosed and low-complexity (AC:L).