This vulnerability (CVE-2026-31844) is an authenticated SQL Injection (CWE-89) in Koha Community's Koha product. It occurs in the staff interface's /cgi-bin/koha/suggestion/suggestion.pl endpoint due to insufficient validation of the displayby parameter in the GetDistinctValues functionality. Successful exploitation requires authenticated staff access and can lead to full compromise of the backend database, including unauthorized disclosure or modification of data. The affected versions explicitly include 24.11.0, 25.05.0, and 25.11.0. There is no vendor advisory or patch information available at this time.

An attacker with authenticated staff privileges can exploit this SQL Injection vulnerability to execute arbitrary SQL commands on the backend database. This can result in full compromise of the database, including unauthorized disclosure or modification of sensitive data stored within Koha. The high CVSS score reflects the significant impact on confidentiality, integrity, and availability of the affected system's data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict staff interface access to trusted users only and monitor for suspicious activity related to the /cgi-bin/koha/suggestion/suggestion.pl endpoint. Avoid using affected versions if possible and apply any vendor-provided updates promptly once released.