CVE-2026-72609 Koha Community Koha - SQL Injection via ORDER BY Direction in acqui/parcels.pl
Authenticated staff can extract sensitive database contents via SQL injection in the acquisition module's parcel handling.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-72609?
CVE-2026-72609 is a high-severity SQL injection vulnerability in Koha, published on 11 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition => order_receive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The parameter is passed to C4::Acquisition::GetInvoices, which allow-lists the column name but concatenates the direction token raw into the SQL ORDER BY clause without validation. Exploitation is blind (time-based) in production and allows extraction of patron PII, staff bcrypt password hashes, and two-factor secrets.
Weakness: CWE-89
Which versions are affected by CVE-2026-72609?
How do I fix CVE-2026-72609?
No fix has been published for CVE-2026-72609 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-72609 being exploited?
There is no known exploitation of CVE-2026-72609 in the wild and no public exploit code.
Sources
Also known as GHSA-f66q-gpm5-hp2p.