Is CVE-2026-72609 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-72609 being exploited in the wild.

How severe is CVE-2026-72609?

High severity, with a CVSS score of 7.1, published 11 August 2026.

Which products and versions are affected?

Koha Community Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01.

Is there a fix for CVE-2026-72609?

A patch was published on 2026-09-03: Patches released in versions 24.11.18, 25.05.13, 25.11.07, 26.05.02 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-72609 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-72609?

Check whether you run Koha Community Koha at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-72609: Koha SQL injection in acquisitions ORDER BY parameter

CVE-2026-72609 · Severity: high · CVSS 7.1 · Published 2026-08-11

Koha is an open-source library management system used by libraries worldwide to manage book acquisitions, patron records, and other library operations. An authenticated staff member with acquisitions permissions can exploit a SQL injection vulnerability in the parcels page to read the entire database, including patron personal information, staff password hashes, and two-factor authentication secrets. The vulnerability requires a valid staff login but affects sensitive institutional and patron data.

Technologies: Koha Community Koha. Vendors: Koha Community.

Quick answers

Is CVE-2026-72609 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-72609 being exploited in the wild.
How severe is CVE-2026-72609?: High severity, with a CVSS score of 7.1, published 11 August 2026.
Which products and versions are affected?: Koha Community Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01.
Is there a fix for CVE-2026-72609?: A patch was published on 2026-09-03: Patches released in versions 24.11.18, 25.05.13, 25.11.07, 26.05.02 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-72609 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-72609?: Check whether you run Koha Community Koha at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a second-order SQL injection in the acquisitions module (acqui/parcels.pl) where the orderby request parameter is passed to C4::Acquisition::GetInvoices(). While the function allow-lists the column name, it concatenates the sort direction (ASC/DESC) directly into the SQL ORDER BY clause without validation. An authenticated staff user with acquisition => order_receive permission can inject arbitrary SQL using inline comments (/**/) to bypass the space-delimiter check, allowing blind time-based extraction of database contents including borrower PII, bcrypt password hashes, and 2FA secrets. The injection point is in the ORDER BY direction token, a distinct variant of similar vulnerabilities reported in report wizards (bugs 42735-42738). Patches were released in versions 24.11.18, 25.05.13, 25.11.07, and 26.05.02 and later.

Affected products

Koha Community Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01

Timeline

2026-06-02: disclosed: Vulnerability reported to Bugzilla
2026-09-03: patched: Patches released in versions 24.11.18, 25.05.13, 25.11.07, 26.05.02 and later

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.