CVE-2026-72609

What it is

An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition => order_receive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The parameter is passed to C4::Acquisition::GetInvoices, which allow-lists the column name but concatenates the direction token raw into the SQL ORDER BY clause without validation. Exploitation is blind (time-based) in production and allows extraction of patron PII, staff bcrypt password hashes, and two-factor secrets.

At a glance

Exploitability

Can be exploited over the network with a low-privilege account. High risk of data exposure.

Exploit odds

0.4% chance of exploitation in the next 30 days (EPSS).

Fix

No patch or advisory is linked yet. Look at mitigations or restrict exposure.

Timeline

1. 2026-08-11 12:17 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-10-24 15:10 UTC Last updatedMost recent change to the record

Details

Published

2026-08-11 12:17 UTC

Last modified

2026-10-24 15:10 UTC

Exploit probability

0.4% · EPSS, next 30 days

Weakness

CWE-89 · SQL injection

Record status

Awaiting Analysis

Attack profile CVSS 3.1 · 7.1

Attack vector

Network

Complexity

Low

Privileges needed

Low

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low