CVE-2026-72609: Koha SQL Injection Vulnerability

CVE-2026-72609 Overview

CVE-2026-72609 is an SQL injection vulnerability [CWE-89] in Koha, the open-source integrated library system. The flaw exists in acqui/parcels.pl and allows authenticated staff members with the acquisition => order_receive permission to read arbitrary database contents. The orderby request parameter is passed to C4::Acquisition::GetInvoices, which validates the column name against an allow-list but concatenates the sort direction token directly into the SQL ORDER BY clause. Exploitation is blind and time-based in production environments, enabling extraction of patron personally identifiable information (PII), staff bcrypt password hashes, and two-factor authentication secrets.

Critical Impact
Authenticated staff can extract sensitive database contents including credential hashes and 2FA secrets through blind SQL injection.

Affected Products

Koha through 24.11.17
Koha through 25.05.12
Koha through 25.11.06 and 26.05.01

Discovery Timeline

2026-08-11 - CVE-2026-72609 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72609

Vulnerability Analysis

The vulnerability resides in the acquisitions workflow handler acqui/parcels.pl. This script accepts an orderby HTTP request parameter that specifies both a column name and a sort direction. The parameter is forwarded to the C4::Acquisition::GetInvoices function, which is responsible for retrieving invoice records from the database.

GetInvoices implements partial input validation. The column name portion of the sort expression is checked against an allow-list of permitted column names. However, the sort direction token, which should only ever be ASC or DESC, is concatenated directly into the SQL ORDER BY clause without any validation or parameterization.

An attacker with the required acquisitions permission can inject arbitrary SQL fragments through the direction token. Because the injection occurs in an ORDER BY clause and the endpoint does not return raw query results to the attacker, exploitation is performed through blind, time-based techniques using functions such as SLEEP().

Root Cause

The root cause is inconsistent input validation. Developers correctly recognized that column names in ORDER BY clauses cannot be parameterized and used an allow-list. They overlooked that the same restriction applies to the direction token, leaving that portion of the query built through raw string concatenation.

Attack Vector

Exploitation requires an authenticated staff session with the acquisition => order_receive permission. The attacker submits a crafted orderby parameter to acqui/parcels.pl over the network. Payloads leverage time-based blind SQL injection to exfiltrate data one bit at a time by observing response delays. Refer to Koha Bug Report #42749 for the reproduction details.

Detection Methods for CVE-2026-72609

Indicators of Compromise

HTTP requests to acqui/parcels.pl containing orderby parameter values that include SQL keywords such as SLEEP, BENCHMARK, IF, CASE, UNION, or comment sequences.
Abnormally long response times from acqui/parcels.pl endpoints, indicative of time-based blind injection.
Repeated authenticated requests to the parcels endpoint from a single staff account within short time windows.

Detection Strategies

Inspect web server access logs for orderby values that deviate from expected columnname ASC or columnname DESC patterns.
Enable MySQL or MariaDB general query logging temporarily to identify malformed ORDER BY clauses reaching the database.
Deploy a web application firewall (WAF) rule that rejects orderby values containing characters outside [A-Za-z0-9_ ].

Monitoring Recommendations

Monitor staff account activity for unusual acquisitions module usage patterns, particularly outside normal working hours.
Alert on database sessions from the Koha application user that execute statements containing time-delay functions.
Track failed and successful authentication events for accounts holding the order_receive permission.

How to Mitigate CVE-2026-72609

Immediate Actions Required

Upgrade Koha to a version that contains the fix for bug #42749, published after 24.11.17, 25.05.12, 25.11.06, and 26.05.01.
Audit which staff accounts hold the acquisition => order_receive permission and revoke it where not required.
Rotate all staff passwords and 2FA secrets if any evidence of exploitation is identified, since bcrypt hashes and TOTP seeds may have been exfiltrated.

Patch Information

Refer to the Koha Bug Report #42749 for patch commits and release notes. Upgrade to the fixed release branch appropriate to your deployment. Additional project information is available at the Koha Community Homepage.

Workarounds

Restrict network access to /cgi-bin/koha/acqui/parcels.pl to trusted management networks only.
Deploy a reverse proxy or WAF rule that validates the orderby parameter against a strict regular expression permitting only known column names and the tokens asc or desc.
Temporarily remove the order_receive permission from non-essential staff accounts until patching is complete.

bash

# Example nginx rule to reject malformed orderby values
location /cgi-bin/koha/acqui/parcels.pl {
    if ($arg_orderby !~ "^[A-Za-z0-9_]+ (asc|desc)$") {
        return 400;
    }
    proxy_pass http://koha_backend;
}