SQL Injection Vulnerability in Koha by Koha Community

CVE-2026-72609

What is CVE-2026-72609?

An SQL injection vulnerability in Koha allows authenticated staff with the acquisition permission to manipulate the database through the orderby request parameter. This vulnerability arises from the improper handling of input in the SQL ORDER BY clause within the acqui/parcels.pl script, enabling attackers to extract sensitive data including patron personally identifiable information (PII), bcrypt password hashes of staff, and two-factor authentication secrets. Exploitation of this vulnerability can occur without direct feedback, making it a significant risk for organizations using affected versions.

References