CVE-2026-50767

MEDIUM 5.4CVE-2026-50767 · Published 26/06/2026 · updated 05/07/2026

In short

CVE-2026-50767 is a MEDIUM (CVSS 5.4) vulnerability affecting koha (koha).
Chance of exploitation in the next 30 days (EPSS): 0.28%, higher than 20.2% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
koha koha	`≤ 25.11.00`	No fix yet

Description

A stored cross-site scripting (XSS) vulnerability in the item type administration page of Koha Library Management System 0 through 25.11 versions allow an authenticated remote attacker with administrator privileges to inject arbitrary web scripts via the item type check-in message field (checkinmsg).

References

lgnas.gitbook.io/findings/cve-2026-50767 · Exploit

More vulnerabilities in koha

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

koha

≤ 25.11.00

No fix yet

Description

More vulnerabilities in koha

See all →