CVE-2026-50766: Stored XSS in Koha Library Management System Item Notes

Technical summary

CVE-2026-50766 is a stored XSS vulnerability (CWE-79) in the OPAC (Online Public Access Catalog) item detail page of Koha. The vulnerability stems from insufficient output encoding in the items.itemnotes field. An authenticated attacker with edit_items permission can inject arbitrary HTML and JavaScript through the item public notes interface. The injected payload is stored in the database and executes when the item detail page is rendered for any user, bypassing single-page context restrictions due to the vulnerability's impact on the broader catalog interface (reflected in the CVSS vector's S:C scope change parameter).

Business impact

For library operations, this vulnerability creates staff-to-patron attack vectors. A compromised staff account or insider with item editing privileges could inject malware that targets all library patrons viewing affected items. Potential impacts include credential theft from patron accounts, redirection to phishing sites, malware distribution, or defacement of the public catalog interface. Libraries relying on Koha for branch identity and patron trust may face reputational damage if the vulnerability is exploited. The attack requires staff-level access, limiting exposure compared to unauthenticated flaws, but libraries with high staff turnover or weak access controls face elevated risk.

Affected systems

Koha Library Management System versions 0 through 25.11 are vulnerable. This includes all releases up to and including the most recent version as of the publication date. Libraries operating any Koha deployment on these versions are potentially affected if staff accounts with edit_items permission exist and are accessible (either locally or via network exposure). Custom deployments or installations with modified permission models should be evaluated individually against the stated permission requirement.

Exploitability

The vulnerability requires two preconditions: the attacker must be authenticated with valid credentials and must possess the edit_items permission role. This significantly reduces the attack surface compared to unauthenticated exploits. However, many libraries assign item editing permissions broadly to circulation and cataloging staff, creating a larger pool of potential attackers. No user interaction is required from the victim—merely viewing the compromised item page triggers the malicious script. The attack is reliable and does not depend on browser quirks or specific client configurations. The medium CVSS score (5.4) reflects the authentication requirement offset by the cross-site scope impact and the ease of execution once access is obtained.

Remediation

Update Koha to a patched version that addresses CVE-2026-50766. Verify the specific patched version against the official Koha project advisory and release notes. In parallel, libraries should audit staff accounts with edit_items permissions, removing unnecessary privilege assignments, and strengthen authentication controls (e.g., enforce strong passwords, enable multi-factor authentication where available). Conduct a security review of the item notes database to identify and remove any injected scripts. Monitor patron-facing access logs for suspicious activity during the window when the vulnerability was present.

Patch guidance

Contact the Koha project or consult the official Koha advisory for the specific version that resolves this vulnerability. Apply patches through the standard Koha update process, testing in a non-production environment first to ensure compatibility with local customizations. After patching, restart the Koha application server and clear any browser caches that may have cached the malicious pages. Libraries should plan patching alongside their regular maintenance windows and communicate any brief downtime to staff and patrons.

Detection guidance

Search the items.itemnotes database field for HTML and JavaScript patterns such as <script>, <iframe>, onerror=, onclick=, and other event handlers, particularly in entries modified around the time of suspected compromise. Review staff access logs for the edit_items permission group, focusing on users making changes to item records outside normal hours or in unusual patterns. Monitor OPAC page loads for console errors or unexpected script execution using browser developer tools or web application firewalls if in place. Consider implementing Content Security Policy (CSP) headers on the OPAC to mitigate stored XSS execution even before patching.

Why prioritize this

Although the CVSS score is medium (5.4), this vulnerability should be prioritized because it affects public-facing catalog systems that serve patrons directly, potentially compromising user trust. The stored nature of the attack means compromise persists until discovered and remediated. Libraries should patch within 30 days of a fix becoming available, sooner if the library has high staff turnover, exposed administrative interfaces, or weak credential management.

Risk score, explained

The CVSS v3.1 score of 5.4 (MEDIUM) is justified by the following factors: attack vector is network-based (AV:N), attack complexity is low (AC:L), and the attack requires low-privilege authentication (PR:L). User interaction is required (UI:R), lowering the score, but the scope changes from single-user to the broader catalog system (S:C), raising it. Confidentiality and integrity are both impacted (C:L, I:L), but availability is not affected (A:N). The authentication requirement is the primary mitigating factor; without valid credentials, the vulnerability cannot be exploited.

Frequently asked questions