CVE-2026-50766 Overview
CVE-2026-50766 is a stored cross-site scripting (XSS) vulnerability affecting the Koha Library Management System. The flaw resides in the Online Public Access Catalog (OPAC) item detail page and impacts versions 0 through 25.11. An authenticated remote attacker with edit_items permission can inject arbitrary web scripts through the item public notes field (items.itemnotes). Injected payloads execute in the browser of any user viewing the affected item's OPAC detail page.
Critical Impact
Authenticated staff with item edit rights can persist JavaScript into item records, hijacking sessions or defacing OPAC content for library patrons who view the item.
Affected Products
- Koha Library Management System versions 0 through 25.11
- Component: koha:koha
- Vulnerable field: items.itemnotes rendered on the OPAC item detail page
Discovery Timeline
- 2026-06-26 - CVE-2026-50766 published to the National Vulnerability Database
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-50766
Vulnerability Analysis
The vulnerability is a stored XSS flaw classified under [CWE-79]: Improper Neutralization of Input During Web Page Generation. Koha stores item metadata, including public notes, in the items.itemnotes database column. When the OPAC item detail page renders this field, the application fails to properly encode or sanitize the stored content before returning it to the browser. Any HTML or JavaScript embedded in the notes executes in the context of the OPAC origin.
Exploitation requires authenticated access with the edit_items permission, which is typically granted to library staff. Successful attacks execute script in the browser of every patron or staff member who views the tampered item record. This enables session token theft, forced actions against the OPAC interface, redirection to attacker-controlled hosts, and phishing overlays targeting library users.
Root Cause
The root cause is missing or insufficient output encoding when the OPAC template renders the items.itemnotes value. User-supplied content is treated as trusted markup rather than escaped text, allowing tag and script injection.
Attack Vector
An attacker authenticates to the Koha staff interface using an account that holds the edit_items permission. The attacker edits an item and stores a JavaScript payload inside the public notes field. When any user browses the OPAC detail page for that item, the browser parses the injected markup and executes the script under the OPAC domain. User interaction (viewing the item page) is required, and the scope is changed because script runs in the victim's authenticated session context.
No verified public proof-of-concept code has been published. See the LGNAS CVE-2026-50766 Findings writeup for technical detail.
Detection Methods for CVE-2026-50766
Indicators of Compromise
- Item records containing HTML tags such as <script>, <img onerror=>, or <svg onload=> inside the items.itemnotes column.
- OPAC responses returning unexpected inline JavaScript or event-handler attributes in item detail HTML.
- Outbound requests from patron browsers to unfamiliar hosts immediately after loading OPAC item pages.
Detection Strategies
- Query the Koha database for items.itemnotes values matching <script, javascript:, on[a-z]+=, or encoded variants and review each match.
- Audit the Koha action log for MODIFY events against item records performed by accounts holding the edit_items permission.
- Deploy Content Security Policy (CSP) reporting on the OPAC to surface inline script violations originating from item pages.
Monitoring Recommendations
- Alert on staff accounts making bulk edits to items.itemnotes outside normal cataloging patterns.
- Monitor web server access logs for referrers pointing to OPAC item detail URLs followed by anomalous cross-origin requests.
- Baseline OPAC page responses and alert on templates returning script content sourced from item metadata fields.
How to Mitigate CVE-2026-50766
Immediate Actions Required
- Restrict the edit_items permission to the minimum set of trusted cataloging staff.
- Audit existing items.itemnotes content and sanitize any values containing HTML or script markup.
- Rotate active session cookies for OPAC users if injection is confirmed on public item pages.
Patch Information
No fixed version is listed in the NVD entry at the time of publication. All Koha releases from 0 through 25.11 are reported as vulnerable. Monitor the Koha project and the LGNAS advisory for a patched release, and apply it as soon as it becomes available.
Workarounds
- Apply an HTTP Content-Security-Policy header on the OPAC that forbids inline scripts and untrusted script sources.
- Deploy a web application firewall rule to strip or block HTML tags submitted to the item notes field in staff requests.
- Temporarily hide the public notes field from OPAC item detail templates until a vendor patch is applied.
# Example Content-Security-Policy header for the OPAC vhost (Apache)
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
