CVE-2026-70373

CVE-2026-70373 is authenticated SQL injection in Koha's reports module, and the 'authenticated' qualifier is doing more work than it should. Yes, you need a Koha staff account with reports permission to exploit this. But that permission boundary is weaker than it appears: libraries, universities, and municipal systems running Koha often have shared accounts, seasonal workers, volunteers, and transient staff with reports access. The permission exists, but its enforcement depends on deployment practices you likely can't audit from the outside. The critical gap: this isn't just data exfiltration. The injection exposes password hashes, TOTP secrets, and API keys stored in the Koha database. Multi-factor authentication provides zero defense because you're extracting the 2FA secrets themselves. And the API keys represent a persistence vector that survives standard remediation. If an attacker extracts api_keys before you patch, rotating Koha passwords and sessions won't help. Those keys likely integrate with discovery layers, interlibrary loan federations, and third-party indexing services — systems operating outside Koha's user permission model entirely. An attacker pivoting through extracted API keys lands in an environment where the original 'authenticated user' requirement has no meaning. Your incident response must go beyond patching. Assume the following are compromised and must be rotated or invalidated: all staff password hashes (force reset), all TOTP secrets (re-enroll users), all session tokens (invalidate active sessions), and all API keys (regenerate). In federated environments with shared cataloging networks, coordinate with downstream partners — the blast radius extends past your Koha deployment. The architectural issue here is that Koha's reports module does direct SQL construction — it's a feature, not a bug, working as designed. Patching this injection point is necessary but creates whack-a-mole risk if the underlying architectural constraint isn't addressed. Monitor for future SQLi in the reports module; the pattern will likely recur.

Reviewed through automated stages and approved by a human before publication.