CVE-2026-72607: Koha SQL Injection Vulnerability

CVE-2026-72607 Overview

CVE-2026-72607 is a stored SQL injection vulnerability in the Koha open-source integrated library system. The flaw affects Koha versions through 24.11.17, 25.05.12, 25.11.06, and 26.05.01. Authenticated staff users holding the tools => items_batchmod permission can inject SQL through the agefield value of an automatic item modification rule. The payload persists in system preferences and executes later when a scheduled cron job runs. Successful exploitation exposes the entire Koha database, including patron personally identifiable information (PII) and staff bcrypt password hashes.

Critical Impact
Authenticated staff with batch item modification rights can read arbitrary database contents, including patron PII and hashed staff credentials, via a stored SQL payload triggered by a scheduled cron job.

Affected Products

Koha through version 24.11.17
Koha through version 25.05.12
Koha through versions 25.11.06 and 26.05.01

Discovery Timeline

2026-08-11 - CVE-2026-72607 published to the National Vulnerability Database (NVD)
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72607

Vulnerability Analysis

The vulnerability is a stored SQL injection classified as [CWE-89]. An authenticated staff user with the tools => items_batchmod permission creates an automatic item modification rule and supplies an SQL payload in the agefield value. Koha writes this value verbatim to a system preference without validation or sanitization.

The stored payload is interpolated directly into an SQL query in C4::Items::ToggleNewStatus at line 1228 when the scheduled cron job later executes the rule. Because the input is concatenated rather than bound as a parameter, the attacker controls SQL syntax executed by the database.

Under default MariaDB and MySQL DBI configuration, only a single statement executes per call, restricting the injection to SELECT-only patterns. However, a time-based SLEEP payload remains achievable through the cron trigger. An attacker can read the entire Koha database, including patron PII and staff bcrypt password hashes.

Root Cause

The root cause is missing input validation on the agefield parameter and absence of parameterized queries in C4::Items::ToggleNewStatus. User-supplied data flows from the web form into a system preference, then into a dynamically constructed SQL string executed by the cron job.

Attack Vector

Exploitation requires network access to the Koha staff interface and an authenticated account with the tools => items_batchmod permission. The attacker creates or edits an automatic item modification rule, placing an SQL fragment in the agefield value. The payload lies dormant until the scheduled cron job runs, at which point the injected SQL executes against the Koha database with the privileges of the Koha database user.

Because execution is deferred to the cron job, exfiltration is typically performed through out-of-band techniques such as time-based blind SQL injection using SLEEP() or by staging results into a location the attacker can later read.

For complete technical detail, see the Koha Community Bug Report #42746.

Detection Methods for CVE-2026-72607

Indicators of Compromise

Automatic item modification rules containing SQL keywords such as SELECT, UNION, SLEEP, or comment sequences (--, #, /*) in the agefield value.
Unusual system preference entries related to automatic_item_modification_by_age that include non-numeric or non-column-name content.
Extended execution time or timeouts logged for the Koha cron job responsible for running item modification rules.

Detection Strategies

Audit the Koha systempreferences table for automatic item modification rule definitions and inspect stored agefield values for SQL syntax.
Review web server and Koha staff interface access logs for POST requests to the automatic item modification rule endpoints made by accounts with the items_batchmod permission.
Correlate cron job execution logs with anomalous MariaDB or MySQL query patterns, particularly long-running queries or queries returning atypical result sets.

Monitoring Recommendations

Enable MariaDB or MySQL general query logging or the slow query log for the Koha database and alert on queries containing suspicious sub-selects originating from the Koha cron user.
Monitor privileged staff account activity, focusing on accounts with the tools => items_batchmod permission for creation or modification of automatic item modification rules.
Alert on repeated database timeouts that align with scheduled Koha cron job intervals, which may indicate SLEEP-based blind SQL injection.

How to Mitigate CVE-2026-72607

Immediate Actions Required

Upgrade Koha to a fixed release beyond 24.11.17, 25.05.12, 25.11.06, and 26.05.01 as published by the Koha Community.
Review existing automatic item modification rules and remove any entries whose agefield value is not a plain column name.
Rotate all staff account credentials, since bcrypt password hashes may have been exfiltrated from vulnerable installations.

Patch Information

The fix is tracked in the Koha Community Bug Report #42746. Administrators should apply upstream patched versions distributed by the Koha Community and verify that C4::Items::ToggleNewStatus uses parameterized queries after upgrade.

Workarounds

Restrict the tools => items_batchmod permission to a minimal set of trusted staff accounts until patching is complete.
Temporarily disable the cron job that processes automatic item modification rules to prevent stored payloads from executing.
Enforce input allow-listing at a reverse proxy or web application firewall by rejecting non-alphanumeric characters in the agefield parameter on rule submission endpoints.

bash

# Example: disable the Koha automatic item modification cron entry
# Edit the Koha crontab and comment out the relevant job
sudo crontab -u koha -e
# Comment the line that invokes automatic_item_modification_by_age.pl
# 0 2 * * * /usr/share/koha/bin/cronjobs/automatic_item_modification_by_age.pl