# CVE-2026-72609: Koha SQL injection in acquisitions ORDER BY parameter

Source: https://junglewise.ai/threats/cve-2026-72609-koha-sql-injection-in-acquisitions-order-by-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-72609 · Severity: high · CVSS 7.1 · Published 2026-08-11

Koha is an open-source library management system used by libraries worldwide to manage book acquisitions, patron records, and other library operations. An authenticated staff member with acquisitions permissions can exploit a SQL injection vulnerability in the parcels page to read the entire database, including patron personal information, staff password hashes, and two-factor authentication secrets. The vulnerability requires a valid staff login but affects sensitive institutional and patron data.

Technologies: [Koha Community Koha](https://junglewise.ai/threats/technologies/koha). Vendors: [Koha Community](https://junglewise.ai/threats/vendors/koha-community).

## Quick answers

**Is CVE-2026-72609 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-72609 being exploited in the wild.

**How severe is CVE-2026-72609?** High severity, with a CVSS score of 7.1, published 11 August 2026.

**Which products and versions are affected?** Koha Community Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01.

**Is there a fix for CVE-2026-72609?** A patch was published on 2026-09-03: Patches released in versions 24.11.18, 25.05.13, 25.11.07, 26.05.02 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-72609 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-72609?** Check whether you run Koha Community Koha at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a second-order SQL injection in the acquisitions module (acqui/parcels.pl) where the orderby request parameter is passed to C4::Acquisition::GetInvoices(). While the function allow-lists the column name, it concatenates the sort direction (ASC/DESC) directly into the SQL ORDER BY clause without validation. An authenticated staff user with acquisition => order_receive permission can inject arbitrary SQL using inline comments (/**/) to bypass the space-delimiter check, allowing blind time-based extraction of database contents including borrower PII, bcrypt password hashes, and 2FA secrets. The injection point is in the ORDER BY direction token, a distinct variant of similar vulnerabilities reported in report wizards (bugs 42735-42738). Patches were released in versions 24.11.18, 25.05.13, 25.11.07, and 26.05.02 and later.

## Affected products

- Koha Community Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01

## Timeline

- 2026-06-02: disclosed: Vulnerability reported to Bugzilla
- 2026-09-03: patched: Patches released in versions 24.11.18, 25.05.13, 25.11.07, 26.05.02 and later

## References

- [https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42749](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42749)
- [https://koha-community.org/](https://koha-community.org/)

## Related threats

- [Koha Library Management System stored XSS in item type administration page](https://junglewise.ai/threats/cve-2026-50767-koha-library-management-system-stored-xss-in-item-type)
- [Koha Library Management System stored XSS in OPAC item detail page](https://junglewise.ai/threats/cve-2026-50766-koha-library-management-system-stored-xss-in-opac-item-detail)
- [Koha Library Management System XSS in patron restriction type administration page](https://junglewise.ai/threats/cve-2026-50765-koha-library-management-system-xss-in-patron-restriction-type)
- [Koha Community Koha SQL injection in reports/catalogue_out.pl](https://junglewise.ai/threats/cve-2026-6428-koha-community-koha-sql-injection-in-reports-catalogue-out-pl)
- [Koha SSRF in Z39.50 configuration module](https://junglewise.ai/threats/cve-2026-26379-koha-ssrf-in-z39-50-configuration-module)