Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Koha Community | Koha | affected |
|
No data.
No data.
| Vendor | Product | Confidence | Versions | ||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Koha-community | Koha | 100% |
|
Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Tue, 11 Aug 2026 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Koha-community
Koha-community koha |
|
| Vendors & Products |
Koha-community
Koha-community koha |
Tue, 11 Aug 2026 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 11 Aug 2026 12:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => items_batchmod permission to execute arbitrary SQL via the agefield value in the automatic item modifications by age tool. The agefield value is stored verbatim and later interpolated without escaping into a SQL query in C4::Items::ToggleNewStatus when the scheduled cron job executes. An attacker can read the entire Koha database including patron PII and staff password hashes, and influence which items the batch job modifies. | A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => items_batchmod permission to read arbitrary database contents by storing a SQL payload in the agefield value of an automatic item modification rule. The agefield value is stored verbatim to the system preference and later interpolated without parameterization into a SQL query in C4::Items::ToggleNewStatus (line 1228) when the scheduled cron job executes. The injection is SELECT-only under standard MariaDB/MySQL DBI single-statement execution; a time-based SLEEP payload is also achievable via the cron trigger. An attacker can read the entire Koha database including patron PII and staff bcrypt password hashes. |
| Metrics |
cvssV3_1
|
cvssV3_1
|
Tue, 11 Aug 2026 11:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => items_batchmod permission to execute arbitrary SQL via the agefield value in the automatic item modifications by age tool. The agefield value is stored verbatim and later interpolated without escaping into a SQL query in C4::Items::ToggleNewStatus when the scheduled cron job executes. An attacker can read the entire Koha database including patron PII and staff password hashes, and influence which items the batch job modifies. | |
| Title | Koha Community Koha - Stored SQL Injection via agefield in Automatic Item Modifications by Age | |
| Weaknesses | CWE-89 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: TuranSec
Published:
Updated: 2026-08-11T12:10:18.466Z
Reserved: 2026-08-10T10:33:03.258Z
Link: CVE-2026-72607
Vulnrichment
Updated: 2026-08-11T12:10:08.775Z
NVD
Status : Received
Published: 2026-08-11T12:17:43.867
Modified: 2026-08-11T13:19:04.733
Link: CVE-2026-72607
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-08-11T17:00:10Z