CVE-2026-70369

Description

Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget_code, aqorders.sort1, and aqorders.sort2. The statement is prepared and executed with no bound parameters. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), borrower_password_recovery, api_keys, and sessions.

Overview

State: PUBLISHED
Assigner (CNA): TuranSec
CVSS severity: HIGH
CVSS score: 8.8 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Effective score: 8.8 / 10 HIGH source: CNA overview
CWE(s): CWE-89
Reserved: 2026-08-04
Published: 2026-08-04 12:59 UTC
Last updated: 2026-08-05 12:53 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/70xxx/CVE-2026-70369.json
Linked Threat: CVE-2026-70369 — Koha: SQL Injection in reports/acquisitions_stats.pl

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-08-04 13:18:57 UTC
NVD last modified: 2026-08-05 13:24:45 UTC
NVD CVSS v3.1: 8.8 / 10 HIGH source: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability subscore: 2.8 / 10
Impact subscore: 5.9 / 10
EPSS score: 0.0025 (probability of exploitation in next 30 days)
EPSS percentile: 16.52% vs all CVEs — higher = more likely to be exploited, as of 2026-08-05

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-52671
Assigner: TuranSec
Published: Aug 4, 2026, 12:59:55 PM
Updated: Aug 5, 2026, 12:53:04 PM
EUVD base score (CVSS 3.1): 8.8 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EUVD-reported EPSS: 0.0000
Vendors: Koha Community
Products: Koha (0 <24.11.17)

Koha (25.05.00 <25.05.12)

Koha (25.11.00 <25.11.06)

Koha (26.05.00 <26.05.01)
Aliases: GHSA-3c33-363c-r2wh

ENISA description: Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget_code, aqorders.sort1, and aqorders.sort2. The statement is prepared and executed with no bound parameters. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), borrower_password_recovery, api_keys, and sessions.

EUVD references (3)

Affected products (1)

Vendor	Product	Versions	Platforms
Koha Community	Koha	`0` (affected), `25.05.00` (affected), `25.11.00` (affected), `26.05.00` (affected)	—

Vendor references (3)

References embedded in the original CVE record by the assigning CNA.

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (3)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42360 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
https://download.koha-community.org/koha-25.05.12.tar.gz 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
https://koha-community.org/koha-25-05-12-released/ 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Remediations (10)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Microsoft Update Catalog

web:catalog.update.microsoft.com

Welcome to the Microsoft Update Catalog site. We want your feedback! Visit our newsgroup or send us an email to provide us with your thoughts and suggestions. To get started using the site, enter in your search terms in the Search box above or visit our FAQ for search tips. |Newsgroup|Send us your feedback

2026-08-06 19:53 UTC
Microsoft Patch Tuesday June 2026 - 198 Vulnerabilities Fixed ...

web:cybersecuritynews.com

Microsoft has released its June 2026 Patch Tuesday security updates, addressing a hefty 198 vulnerabilities across its product ecosystem. The June rollout, published on June 9, 2026 , stands out not only for its volume but also for the inclusion of three zero-day vulnerabilities that were actively exploited or publicly known before a fix was available. Administrators are urged to prioritize ...

2026-08-06 19:53 UTC
CVE-2026-40369: Windows Kernel Privilege Escalation Vulnerability ...

web:integsec.com

C — Mitigation & Remediation 1. Immediate (0-24h): Apply the official May 2026 Microsoft cumulative update for affected Windows 11 and Server 2025 versions via Windows Update, WSUS, or SCCM. Prioritize servers, developer workstations, and multi-user systems. Reboot required. 2.

2026-08-06 19:53 UTC
Nvd - Cve-2026-50369

web:nvd.nist.gov

Description Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges over a network.

2026-08-06 19:53 UTC
Security Update Guide - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-08-06 19:53 UTC
SAP Security Patch Day - June 2026

web:support.sap.com

SAP security Patch Day Bulletin This post shares the information on security notes that remediate vulnerabilities discovered in SAP products. SAP strongly recommends that the customer visits the support portal and applies patches on priority to protect their SAP landscape. On 9th of June 2026 , SAP security patch day saw the release of 15 new security notes.

2026-08-06 19:53 UTC
CVE-2026-50369 - vulnerability database | Vulners.com

web:vulners.com

CVE - 2026 -50369 is a Windows Remote Desktop Services vulnerability identified as a use-after-free that enables an authorized attacker to elevate privileges over the network. The initial entry and multiple connected sources describe the issue consis...

2026-08-06 19:53 UTC
CVE-2026-50369: Patch Windows RDP Privilege Escalation

web:windowsforum.com

Microsoft has fixed CVE - 2026 -50369, an Important-rated Windows Remote Desktop Services vulnerability that could let an authenticated attacker elevate privileges across a network. The flaw carries a CVSS 3.1 base score of 8.8 and affects supported Windows client and server releases, including Windows 11 24H2, 25H2 and 26H1 as well as Windows Server 2012 through Windows Server 2025. Detailed in ...

2026-08-06 19:53 UTC
Critical Patches Issued for Microsoft Products, July 14, 2026

web:www.cisecurity.org

Microsoft reports CVE - 2026 -56164 has been exploited in the wild. CVE - 2026 -56164 may allow remote cyber threat actors to gain unauthorized access to on-premises SharePoint Server instances. Microsoft noted that integrating its Antimalware Scan Interface (AMSI) can provide temporary mitigation by actively scanning and detecting malicious POST requests associated with exploitation attempts. The ...

2026-08-06 19:53 UTC
July 2026 Patch Tuesday: Largest Patch Tuesday 569 CVEs - Tenable

web:www.tenable.com

Microsoft patched 569 CVEs in July 2026 , the largest Patch Tuesday release in its history. 56 critical CVEs patched including three zero-day vulnerabilities.

2026-08-06 19:53 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-70369.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-70369",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-04T17:20:31.267167Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-04T17:20:36.590Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://koha-community.org/",
          "defaultStatus": "unaffected",
          "product": "Koha",
          "programFiles": [
            "reports/acquisitions_stats.pl"
          ],
          "repo": "https://gitlab.com/koha-community/Koha",
          "vendor": "Koha Community",
          "versions": [
            {
              "lessThan": "24.11.17",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "25.05.12",
              "status": "affected",
              "version": "25.05.00",
              "versionType": "semver"
            },
            {
              "lessThan": "25.11.06",
              "status": "affected",
              "version": "25.11.00",
              "versionType": "semver"
            },
            {
              "lessThan": "26.05.01",
              "status": "affected",
              "version": "26.05.00",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sanjar Tulkinov Anvar o'g'li"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget_code, aqorders.sort1, and aqorders.sort2. The statement is prepared and executed with no bound parameters. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), borrower_password_recovery, api_keys, and sessions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:53:04.718Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42360"
        },
        {
          "url": "https://koha-community.org/koha-25-05-12-released/"
        },
        {
          "url": "https://download.koha-community.org/koha-25.05.12.tar.gz"
        }
      ],
      "title": "Koha: SQL Injection in reports/acquisitions_stats.pl"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-70369",
    "datePublished": "2026-08-04T12:59:55.938Z",
    "dateReserved": "2026-08-04T07:13:07.992Z",
    "dateUpdated": "2026-08-05T12:53:04.718Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}