CVE-2026-50766
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A stored cross-site scripting (XSS) vulnerability in the OPAC item detail page of Koha Library Management System versions 0 through 25.11 allows an authenticated remote attacker with edit_items permission to inject arbitrary web scripts via the item public notes field (items.itemnotes).
Risk Assessment
An attacker can steal user sessions, redirect users to malicious sites, or exfiltrate library data, compromising the confidentiality and integrity of the system.
Recommendation
Immediately upgrade Koha to version 25.11.xx or later, which includes a fix for this vulnerability. Until the update is applied, restrict edit_items permissions to trusted users only.
Other vulnerabilities in Koha Library Management System
See all- CVE-2026-50767Medium
A stored cross-site scripting (XSS) vulnerability in Koha Library Management System versions 0 through 25.11 allows an authenticated remote attacker with admin privileges to inject arbitrary scripts via the item type check-in message field.
- CVE-2026-50765Medium
A stored cross-site scripting (XSS) vulnerability was discovered in the patron restriction type administration page of Koha Library Management System versions 0 through 25.11. It allows an authenticated remote attacker with administrator privileges to inject arbitrary web scripts via the restriction type label (display_text field).
Original NVD description (English source)
A stored cross-site scripting (XSS) vulnerability in the OPAC item detail page of Koha Library Management System 0 through 25.11 versions allow an authenticated remote attacker with edit_items permission to inject arbitrary web scripts via the item public notes field (items.itemnotes).