Koha Community up to 24.11.17/25.05.12/25.11.6/26.05.1 Automatic Item Modification ToggleNewStatus agefield sql injection

Summaryinfo

A vulnerability was found in Koha Community Koha up to 24.11.17/25.05.12/25.11.6/26.05.1 and classified as critical. This issue affects the function C4::Items::ToggleNewStatus of the component Automatic Item Modification. Executing a manipulation of the argument agefield can lead to sql injection. The identification of this vulnerability is CVE-2026-72607. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability has been found in Koha Community Koha up to 24.11.17/25.05.12/25.11.6/26.05.1 and classified as critical. This vulnerability affects the function C4::Items::ToggleNewStatus of the component Automatic Item Modification. The manipulation of the argument agefield with an unknown input leads to a sql injection vulnerability. The CWE definition for the vulnerability is CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => items_batchmod permission to read arbitrary database contents by storing a SQL payload in the agefield value of an automatic item modification rule. The agefield value is stored verbatim to the system preference and later interpolated without parameterization into a SQL query in C4::Items::ToggleNewStatus (line 1228) when the scheduled cron job executes. The injection is SELECT-only under standard MariaDB/MySQL DBI single-statement execution; a time-based SLEEP payload is also achievable via the cron trigger. An attacker can read the entire Koha database including patron PII and staff bcrypt password hashes.

The advisory is shared for download at bugs.koha-community.org. This vulnerability was named CVE-2026-72607 since 08/10/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1505.

Upgrading to version 24.11.18, 25.05.13, 25.11.07 or 26.05.02 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-56128). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Koha Community

Name

• Koha

Version

• 24.11.0
• 24.11.1
• 24.11.2
• 24.11.3
• 24.11.4
• 24.11.5
• 24.11.6
• 24.11.7
• 24.11.8
• 24.11.9
• 24.11.10
• 24.11.11
• 24.11.12
• 24.11.13
• 24.11.14
• 24.11.15
• 24.11.16
• 24.11.17
• 25.05.0
• 25.05.1
• 25.05.2
• 25.05.3
• 25.05.4
• 25.05.5
• 25.05.6
• 25.05.7
• 25.05.8
• 25.05.9
• 25.05.10
• 25.05.11
• 25.05.12
• 25.11.0
• 25.11.1
• 25.11.2
• 25.11.3
• 25.11.4
• 25.11.5
• 25.11.6
• 26.05.0
• 26.05.1

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion