CVE-2026-50765: Stored XSS in Koha Library Management System Patron Restrictions

Technical summary

CVE-2026-50765 is a stored XSS vulnerability (CWE-79) affecting Koha versions 0 through 25.11. The vulnerability exists in the patron restriction type administration page, specifically in the display_text field used for restriction type labels. An authenticated attacker with administrator privileges can inject arbitrary JavaScript that persists in the application's database. When other users access the restriction administration interface, the malicious script executes in their browser context with their privileges, enabling session hijacking, credential theft, or further lateral movement within the library system.

Business impact

For libraries using Koha, this vulnerability creates an insider threat risk where a compromised or malicious administrator account can attack other staff members. The impact extends beyond the Koha system itself—library patron data, circulation records, and integrated systems (financial, ILS-connected discovery systems) could be exposed. In smaller libraries with limited IT oversight, a single compromised admin account could lead to unauthorized access to patron information, circulation history, and potentially integration with external systems. Recovery requires identifying and removing injected payloads and resetting affected administrator credentials.

Affected systems

All Koha Library Management System installations from version 0 through version 25.11 are vulnerable. The vulnerability requires administrator-level access to exploit, limiting the immediate attack surface to staff accounts with administrative privileges. Organizations running Koha should inventory their deployments and current patch levels immediately.

Exploitability

Exploitation requires valid administrator credentials to access the patron restriction type administration page. The vulnerability has a CVSS 3.1 score of 6.1 (MEDIUM) with a network-accessible vector, low attack complexity, and no privilege escalation required beyond the administrator role already held. While not in CISA's Known Exploited Vulnerabilities catalog, the straightforward injection mechanism and persistent storage nature mean exploitation is trivial once an attacker has admin access. The barrier is credential acquisition, not technical exploitation difficulty.

Remediation

Organizations should upgrade Koha to a patched version above 25.11 that implements output encoding and input validation on the restriction type display_text field. Until patches are available, restrict administrator account access to trusted personnel only, implement account activity monitoring, and consider disabling the patron restriction type administration feature if not actively used. Monitor web server and application logs for suspicious administrative activities.

Patch guidance

Verify patch availability from the Koha project's official release channels and security advisories. Apply patches to all Koha instances in your environment. Test patches in a non-production environment first to ensure compatibility with any local customizations. Given the administrator-only requirement, patches can often be deployed during standard maintenance windows without affecting patron-facing services.

Detection guidance

Monitor administrator access to the patron restriction type administration interface. Audit logs should capture modifications to restriction type records, particularly the display_text field. Search for unusual JavaScript patterns, HTML tags, or encoded payloads in restriction type labels. Network-based detection can identify reflected XSS attempts in HTTP parameters, though stored XSS detection requires application-level logging. Review administrator account activity for unexpected access times, geographic locations, or bulk modifications to restriction types.

Why prioritize this

While scored as MEDIUM severity, this vulnerability merits prompt attention because: (1) it affects a widely-deployed open-source library system, (2) stored XSS provides persistent compromise, (3) it affects sensitive patron data, and (4) the administrative access requirement, while limiting scope, makes it attractive to insider threats. Libraries are often targeted for patron data breaches. Prioritize based on your institution's reliance on Koha and the sensitivity of patron information in your system.

Risk score, explained

The CVSS 3.1 score of 6.1 reflects a network-accessible vulnerability with no privilege escalation required beyond the administrator role, but limited to users who can authenticate and reach the affected page. The score does not account for persistence (stored payload remains across sessions), the sensitivity of library patron data, or the trustworthiness typically placed in administrative interfaces, which may elevate practical risk above the base score in library environments.

Frequently asked questions