CVE-2026-72609
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
An SQL injection vulnerability in Koha (through 24.11.17, 25.05.12, 25.11.06, and 26.05.01) allows authenticated staff with the acquisition => order_receive permission to read arbitrary database contents via the orderby parameter in acqui/parcels.pl. The parameter is passed to C4::Acquisition::GetInvoices, which concatenates the direction token raw into the SQL ORDER BY clause without validation. Exploitation is blind (time-based) and allows extraction of patron PII, staff bcrypt password hashes, and two-factor secrets.
Risk Assessment
Authenticated staff can access sensitive database contents, including personal data and password hashes, potentially leading to privacy and security breaches.
Recommendation
Update Koha to a version newer than 26.05.01 or apply a patch that validates the orderby parameter.
Original NVD description (English source)
An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition => order_receive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The parameter is passed to C4::Acquisition::GetInvoices, which allow-lists the column name but concatenates the direction token raw into the SQL ORDER BY clause without validation. Exploitation is blind (time-based) in production and allows extraction of patron PII, staff bcrypt password hashes, and two-factor secrets.