vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-72609

Koha Community Koha - SQL Injection via ORDER BY Direction in acqui/parcels.pl

HIGH
7.1
CVSS Score
Published: August 11, 2026 at 11:22 AM UTC
Updated: October 24, 2026 at 03:10 PM UTC
1 product affected across 1 vendorKoha

Using Koha by Koha Community?

Get instant alerts when new vulnerabilities affect Koha - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.1
Exploit prediction
EPSS 0.4%
SSVC
No known exploit

Description

An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition => order_receive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The parameter is passed to C4::Acquisition::GetInvoices, which allow-lists the column name but concatenates the direction token raw into the SQL ORDER BY clause without validation. Exploitation is blind (time-based) in production and allows extraction of patron PII, staff bcrypt password hashes, and two-factor secrets.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Koha· Koha Community
90%
0 ≤ v < 24.11.1825.05.0 ≤ v < 25.05.1325.11.0 ≤ v < 25.11.0726.05.0 ≤ v < 26.05.02025.05.025.11.026.05.0
Affected range stops below 24.11.18, so it looks safe — our inference, not a vendor statement
Affected range stops below 25.05.13, so it looks safe — our inference, not a vendor statement
Affected range stops below 25.11.07, so it looks safe — our inference, not a vendor statement
Affected range stops below 26.05.02, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (2)

Source: cverecord
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42749
Source: cverecord
https://koha-community.org/

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.1HIGHTuranSec
Vector?

Quick Info

StatusAWAITING ANALYSIS
CWE
CWE-89

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card