AUGUST 16, 2026
Live Feed
Back to database
Case File

CVE-2026-70372

HIGH · CVSS 8.8 EPSS 0.31%

Source: NVD + CISA KEV + EPSS · Published 2026-08-04 · Last synced 2026-08-16

CyberRota Analysis

AI-Generated

Koha's reports module is vulnerable to SQL injection due to improper handling of user-controlled parameters in the bor_issues_top.pl script, allowing authenticated staff users to manipulate SQL queries. This vulnerability can lead to unauthorized access to sensitive data, including borrower information and authentication secrets. Organizations using Koha, particularly those with staff members who have access to the reports module, should prioritize addressing this issue to mitigate potential data breaches.

CVE
CVE-2026-70372
Severity
HIGH
CVSS
8.8
EPSS
0.31%

Original NVD Description

Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.