CVE-2026-50767: Koha Library Management System XSS Flaw

CVE-2026-50767 Overview

CVE-2026-50767 is a stored cross-site scripting (XSS) vulnerability in the Koha Library Management System. The flaw resides in the item type administration page, specifically the check-in message field (checkinmsg). An authenticated attacker with administrator privileges can inject arbitrary JavaScript that executes in the browsers of other users who view affected pages. The vulnerability affects Koha versions 0 through 25.11 and is tracked under CWE-79. Full technical details are available in the GitBook CVE-2026-50767 Findings writeup.

Critical Impact
An authenticated administrator can persist malicious scripts in the checkinmsg field, enabling session hijacking, credential theft, or unauthorized actions against library staff and patrons who load the affected item type page.

Affected Products

Koha Library Management System versions 0 through 25.11
Koha item type administration module
Koha check-in message (checkinmsg) field handler

Discovery Timeline

2026-06-26 - CVE-2026-50767 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-50767

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in the Koha item type administration workflow. The checkinmsg input accepts arbitrary HTML and JavaScript content without sufficient output encoding. When an administrator creates or edits an item type and supplies a payload, the malicious content is persisted in the database. Any subsequent rendering of the check-in message reflects the payload into the DOM and executes it in the victim's browser session.

The scope change indicated by the CVSS vector reflects that the injected script executes in the context of the Koha web interface, potentially affecting users beyond the attacker's own session. Staff accounts performing routine circulation actions are the primary victims. Successful exploitation allows an attacker to steal session cookies, perform actions on behalf of a librarian, or pivot deeper into the library's administrative interface.

Root Cause

The root cause is missing or insufficient contextual output encoding when rendering the checkinmsg value stored for an item type. User-supplied content is written back into HTML contexts without encoding characters such as <, >, ", and '. This aligns with CWE-79: Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation requires an authenticated session with administrator privileges and user interaction from a victim who views the check-in message. The attacker navigates to the item type administration page, edits or creates an item type, and stores a script payload in the checkinmsg field. When library staff subsequently process a check-in that references the affected item type, the payload runs in their browser under the Koha application origin.

Because the vulnerability requires administrator credentials, it is most relevant in scenarios involving compromised admin accounts, insider threats, or environments where administrator roles are broadly delegated across multiple staff. See the GitBook CVE-2026-50767 Findings for reproduction steps.

Detection Methods for CVE-2026-50767

Indicators of Compromise

Presence of HTML tags such as <script>, <img onerror=>, or <svg onload=> stored in the checkinmsg column of Koha's item type table
Unexpected outbound HTTP requests from staff browsers to attacker-controlled domains shortly after loading Koha circulation pages
Audit log entries showing item type modifications by administrator accounts outside of change-management windows

Detection Strategies

Query the Koha database for item type records containing HTML control characters or javascript: URIs in checkinmsg and related message fields
Enable and review web server access logs for suspicious POST requests to the item type administration endpoints
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script executions originating from Koha pages

Monitoring Recommendations

Alert on administrator account logins from unusual source IPs or geographies, since exploitation requires admin privileges
Monitor for privilege changes that grant users the parameters_remaining_permissions or item type management capability in Koha
Correlate item type configuration changes with subsequent anomalous session activity from staff accounts

How to Mitigate CVE-2026-50767

Immediate Actions Required

Audit all existing item type checkinmsg values and remove any content containing HTML tags, event handlers, or javascript: schemes
Restrict administrator privileges to the minimum set of staff required to manage item types
Enforce multi-factor authentication on all Koha administrator accounts to reduce the risk of credential compromise

Patch Information

No vendor patch URL is listed in the NVD record at the time of publication. Administrators should monitor the Koha project homepage and the official Koha security announcements for a fixed release addressing versions through 25.11. Upgrade to the vendor-supplied fixed version as soon as it becomes available.

Workarounds

Apply a strict Content Security Policy that disallows inline scripts and unsafe evaluation on the Koha staff interface
Place Koha behind a web application firewall configured to block payloads containing HTML tags in item type administration requests
Sanitize existing database entries by stripping HTML from the checkinmsg field until an official patch is deployed

bash

# Example: identify item types with suspicious checkinmsg content
mysql -u koha_user -p koha_db -e \
  "SELECT itemtype, checkinmsg FROM itemtypes \
   WHERE checkinmsg REGEXP '<[a-zA-Z]|javascript:|on[a-z]+=';"