What is CVE-2026-6428?

CVE-2026-6428 is a high-severity vulnerability in Koha Community, classified under SQL Injection. CVSS score: 7.6/10. Published 2026-06-13.

How severe is CVE-2026-6428?

High severity. CVSS v3 base score is 7.6 out of 10.

SQL Injection in Koha Community

CVE-2026-6428

SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/.

Vulnerability class: SQL Injection

EPSS: 0.002 (15.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L.

Affected products

Koha Community — versions 0, 23.05.00, 24.05.00

Weakness classification (CWE)

CWE-89 — SQL Injection

References

309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c (vendor-advisory, patch)
309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c (issue-tracking, vendor-advisory)
309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c (vendor-advisory)

Frequently asked questions

What is CVE-2026-6428?: CVE-2026-6428 is a high-severity vulnerability in Koha Community, classified under SQL Injection. CVSS score: 7.6/10. Published 2026-06-13.
How severe is CVE-2026-6428?: High severity. CVSS v3 base score is 7.6 out of 10.