CVE-2026-50767: Stored XSS in Koha Library Management System

Technical summary

CVE-2026-50767 is a stored XSS vulnerability (CWE-79) affecting Koha versions 0 through 25.11. The vulnerability exists in the item type administration page, specifically in the checkinmsg (check-in message) field. An authenticated user with administrator privileges can inject arbitrary JavaScript that persists in the database. When other users access the affected item type configuration or related interfaces, the stored script executes in their browser context, potentially enabling session hijacking, credential theft, or lateral movement within the library system.

Business impact

For library organizations, this vulnerability poses a direct threat to staff and patron data security. An insider threat or compromised administrator account could inject scripts that harvest login credentials from librarians, manipulate circulation records, or exfiltrate patron information. The persistence of stored XSS means malicious scripts remain active until discovery and remediation, extending exposure window and increasing detection difficulty. Organizations relying on Koha for sensitive patron privacy management face both operational disruption and regulatory liability under data protection frameworks.

Affected systems

Koha Library Management System versions 0 through 25.11 are vulnerable. This affects both on-premise and hosted deployments where administrator accounts exist. The vulnerability requires administrator-level authentication to exploit, limiting the threat pool to privileged internal users or attackers who have compromised administrative credentials. Organizations running current versions (25.11 and earlier) should treat this as an active risk.

Exploitability

Exploitation requires valid administrator credentials and direct access to the item type administration interface. The barrier to entry is moderate—an attacker must either be a trusted insider or successfully compromise an administrator account through separate means (phishing, credential reuse, etc.). Once access is obtained, injection is straightforward and requires no special tools. The reliance on user interaction (victims must view the affected page) and the requirement for prior authentication keep the CVSS score at Medium (5.4), but the stored nature of the payload and its execution across multiple user sessions creates compounding risk.

Remediation

Prioritize patching Koha to a version that remedies this XSS vulnerability. Verify the specific patched version number in the official Koha security advisory. Until patching is possible, implement input validation and output encoding controls on the checkinmsg field at the application layer if your deployment permits. Conduct an audit of recent changes to item type configurations and check administrator account activity logs for unauthorized modifications. Review any stored messages for suspicious JavaScript or HTML content.

Patch guidance

Check the Koha project's official security advisories and release notes for the corrected version number. Apply the patch during a scheduled maintenance window, as item type configuration changes may impact library operations during deployment. Test the patch in a staging environment first, verifying that legitimate check-in message functionality remains intact. Confirm that all existing item type records are sanitized of any injected content post-patch.

Detection guidance

Monitor Koha administrator account activity logs for modifications to item type configurations, particularly the checkinmsg field. Use browser developer tools or network inspection to examine the HTML/JavaScript returned when accessing item type administration pages—look for unexpected script tags or encoded payloads in message fields. Implement Content Security Policy (CSP) headers at the application or reverse proxy level to restrict script execution. Search your Koha database directly for suspicious patterns in the checkinmsg column (e.g., <script, javascript:, onerror=).

Why prioritize this

Although the CVSS score is Medium (5.4), this vulnerability merits prompt attention due to its stored nature, impact on multiple users, and the sensitive data libraries manage. The requirement for administrator authentication reduces immediate external risk, but insider threats and credential compromise are realistic attack scenarios in any organization. Libraries handling patron records subject to privacy regulations should treat this as high-priority for rapid patching and verification.

Risk score, explained

The CVSS v3.1 score of 5.4 (Medium) reflects the combination of low attack vector complexity, requirement for administrator-level privileges (PR:L), and user interaction (UI:R). The scope change (S:C) acknowledges that the script executes in the context of other users' sessions, creating cross-user impact. However, the lack of availability impact (A:N) and the reliance on stored payload discovery by a victim prevent a higher severity rating. In practice, organizational risk may be higher due to the persistence of the payload and the critical nature of library data.

Frequently asked questions