PatchTheCVECVE-2026-72607: A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authent
CVE-2026-72607 is a high-severity flaw (CVSS 7.1) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => items_batchmod permission to read arbitrary database contents by storing a SQL payload in the agefield value of an automatic item modification rule. The agefield value is stored verbatim to the system preference and later interpolated without parameterization into a SQL query in C4::Items::ToggleNewStatus (l
Why this priority
- High severity
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.1 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.5% (top 62%) |
| CISA exploited list | No |
| Weakness | CWE-89 |
| Published | 2026-08-11 |
| Last modified | 2026-10-23 |
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-72607?
No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.
Is CVE-2026-72607 being exploited?
CVE-2026-72607 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-72607 affect?
CVE-2026-72607 affects affected software. Severity is high (CVSS 7.1). A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => items_batchmod permission to read arbitrary database contents by storing a SQL payload in the agefi
How urgent is CVE-2026-72607?
Priority 34/100. High severity