CVE-2026-50765: Koha Library Management System XSS Flaw

CVE-2026-50765 Overview

CVE-2026-50765 is a stored cross-site scripting (XSS) vulnerability affecting the Koha Library Management System versions 0 through 25.11. The flaw resides in the patron restriction type administration page, where the display_text field of the restriction type label fails to sanitize user-supplied input. An authenticated attacker holding administrator privileges can inject arbitrary JavaScript that executes in the browsers of other users who view the affected page. The issue is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact

Persistent JavaScript payloads stored in the restriction type label execute in staff and administrator sessions, enabling session hijacking, defacement, or forced actions against the Koha management interface.

Affected Products

• Koha Library Management System versions 0 through 25.11
• Koha staff administration interface (patron restriction type module)
• Deployments exposing the administration page to networked users

Discovery Timeline

• 2026-06-26 - CVE-2026-50765 published to NVD
• 2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-50765

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the patron restriction type administration workflow of Koha. The display_text field, which defines the human-readable label for a patron restriction type, accepts arbitrary characters and stores them without HTML encoding. When the stored value is rendered back into the administration page, the browser interprets the injected markup as executable script.

Because the payload persists in the Koha database, every subsequent visit to the affected administration view triggers execution. The attack surface includes any staff account, including higher-privileged administrators, who navigate to the restriction type listing.

Exploitation requires authenticated access with administrator privileges to inject the payload, but the executed script runs in the context of any user who later views the page. This creates a lateral abuse path for a rogue or compromised administrator account.

Root Cause

The root cause is missing output encoding of the display_text field on both storage and rendering paths. Koha does not neutralize HTML control characters such as <, >, and " before writing the value into the response body, allowing raw <script> tags and event handler attributes to reach the DOM.

Attack Vector

An attacker with administrator credentials submits a crafted restriction type label containing JavaScript through the standard Koha administration form. The payload is stored in the backend database. When another user opens the patron restriction type administration page, the malicious script executes in their session, enabling cookie theft, CSRF token exfiltration, or arbitrary requests to the Koha application on their behalf.

No verified public exploit code is available. Technical details are documented in the GitBook CVE-2026-50765 Findings writeup.

Detection Methods for CVE-2026-50765

Indicators of Compromise

• Restriction type labels containing HTML tags, <script> elements, or on* event handler attributes in the display_text field
• Unexpected outbound HTTP requests from staff browsers to attacker-controlled domains after opening the Koha administration interface
• Audit log entries showing creation or modification of patron restriction types by accounts that do not normally manage patron configuration

Detection Strategies

• Query the Koha database for restriction type rows whose display_text contains angle brackets, quotes, or JavaScript keywords such as alert, document.cookie, or fetch(
• Enable and review web server access logs for POST requests to the patron restriction type administration endpoint originating from unusual source addresses
• Deploy Content Security Policy (CSP) reporting to surface inline script execution attempts inside the Koha staff interface

Monitoring Recommendations

• Alert on modifications to Koha administrative tables performed outside approved change windows
• Monitor staff browser sessions for anomalous DOM-based requests, particularly to endpoints handling patron data export or user management
• Track privileged administrator account activity for indicators of credential compromise that could enable payload injection

How to Mitigate CVE-2026-50765

Immediate Actions Required

• Restrict access to the patron restriction type administration page to a minimal set of trusted administrator accounts
• Audit existing restriction type entries and remove any records containing HTML or script content in the display_text field
• Enforce multi-factor authentication on all Koha administrator accounts to reduce the risk of credential-based payload injection

Patch Information

Refer to the Koha official site and the GitBook CVE-2026-50765 Findings for the latest remediation status. Upgrade to a Koha release later than 25.11 once a fixed version is published by the maintainers.

Workarounds

• Apply a strict Content Security Policy that disallows inline scripts within the Koha staff interface
• Place the Koha administration interface behind a web application firewall with rules that block angle brackets and script tokens in restriction-related parameters
• Limit administrator role assignments and review the privileged user list on a recurring basis

# Configuration example: sample CSP header for the Koha staff interface
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"