# CVE-2026-72607: Koha stored SQL injection in automatic item modification rules

Source: https://junglewise.ai/threats/cve-2026-72607-koha-stored-sql-injection-in-automatic-item-modification-rules  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-72607 · Severity: high · CVSS 7.1 · Published 2026-08-11

Koha is a free and open-source library management system used by libraries to catalog items and manage patron data. A vulnerability allows authenticated staff members with batch modification permissions to inject malicious SQL code into automatic item modification rules. When the system's scheduled maintenance job runs, this injected code executes against the database, allowing attackers to read sensitive data including patron personal information and staff password hashes.

## Quick answers

**Is CVE-2026-72607 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-72607 being exploited in the wild.

**How severe is CVE-2026-72607?** High severity, with a CVSS score of 7.1, published 11 August 2026.

**Which products and versions are affected?** Koha Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01.

**Is there a fix for CVE-2026-72607?** A patch was published on 2026-09-03: Patches released in versions 26.11.00, 26.05.02, 25.11.07, 25.05.13, 24.11.18 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-72607 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-72607?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a stored SQL injection vulnerability (CWE-89) in Koha's automatic item modification by age feature. The vulnerability exists in the `agefield` parameter of automatic item modification rules, which is accepted and stored verbatim without validation in `tools/automatic_item_modification_by_age.pl`. When the scheduled cron job (`misc/cronjobs/automatic_item_modification_by_age.pl`) executes, it calls `C4::Items::ToggleNewStatus`, which interpolates the stored `agefield` value directly into a SQL query without parameterization. An authenticated attacker with `tools_items_batchmod` permission can craft a malicious rule containing SQL injection payloads in the agefield; the injection triggers when the cron job runs and can execute SELECT queries to extract arbitrary database contents, including patron PII and bcrypt password hashes. Under standard MariaDB/MySQL DBI single-statement execution, time-based blind SQL injection via SLEEP is also achievable.

## Affected products

- Koha Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01

## Timeline

- 2026-08-11: disclosed: CVE-2026-72607 published on NVD
- 2026-06-02: advisory: Vulnerability reported to Koha Bugzilla
- 2026-09-03: patched: Patches released in versions 26.11.00, 26.05.02, 25.11.07, 25.05.13, 24.11.18

## References

- [https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42746](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42746)
- [https://koha-community.org/](https://koha-community.org/)