CVE-2026-70371

This SQL injection in Koha's reports module warrants more attention than its CVSS 8.8 suggests — not because the score is wrong, but because the 'authenticated user' condition is a weaker barrier than it appears. The vulnerability lives in the Line and Column parameters of the reports endpoint. These values are being concatenated directly into GROUP BY and ORDER BY clauses — SQL's identifier positions, not value positions. This cannot be fixed with parameterized queries; SQL has no way to bind column names as parameters. The only correct mitigation is whitelist validation against a known-good schema list of permitted column names. If the current code lacks this validation, assume it's vulnerable. The permission-scope question is the underweighted variable. The reports module in Koha handles routine library operations — circulation statistics, overdue reports, collection analytics. These are daily tasks for branch librarians, not system administrators. In most Koha deployments, the reports permission is granted to a broad staff class, not a narrow admin group. Treat the 'authenticated user' constraint as a thin technical boundary, not a meaningful security boundary. Your attacker pool is likely most of your staff. The data exposure is severe in a way CVSS underweights. The dump includes borrower password hashes and — critically — TOTP secrets. Extracting TOTP secrets is not credential theft for offline cracking; it is immediate authentication bypass. An attacker with a valid session can harvest TOTP secrets for every user in the database, then bypass two-factor authentication on any account, including administrators. This converts a data breach into persistent infrastructure capture. Check your Koha deployment: review which roles hold the reports module permission, restrict that permission to the smallest possible group, and examine the reports module's parameter handling code for column/line parameter concatenation. If whitelist validation for column names is absent, treat the module as exploitable until patched. The EPSS score is low, but it measures exploitation probability against a newly disclosed CVE — not the years of exposure while the injection primitive sat in production with broad staff access.

Reviewed through automated stages and approved by a human before publication.